Extracting prog: 24m15.413477136s
Minimizing prog: 13m58.113525976s
Simplifying prog options: 0s
Extracting C: 1m3.194124625s
Simplifying C: 8m25.20859485s


extracting reproducer from 44 programs
testing a last program of every proc
single: executing 9 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$inet6-ioctl-ioctl-setsockopt-sendto$inet6
detailed listing:
executing program 0:
setns(0xc9, 0x40000000)
r0 = socket$inet6(0xa, 0x2, 0x0)
ioctl(r0, 0x8914, &(0x7f0000000000)="7770616e3000000000000000000000000100"/40)
ioctl(r0, 0x8914, &(0x7f0000000040)="6c6f7770616e300000000000000000000100"/40)
setsockopt(r0, 0x1, 0x19, &(0x7f0000000080)='lowpan0\x00', 0x8)
sendto$inet6(r0, &(0x7f0000000100)='lowpan_payload', 0xe, 0x0, &(0x7f0000000140)={0xa, 0x1234, 0x0, @empty}, 0x1c)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-syz_genetlink_get_family_id$nl80211-bpf$MAP_CREATE-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0)
bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1900"], 0x50)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002bbd7000fddbdf253700000008000300", @ANYRES32=r1, @ANYBLOB="080026006c0900000800a0006c09000008005700881300000800a10000100000080027"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x90)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$rtl8150-syz_usb_control_io$rtl8150-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000240)=ANY=[@ANYBLOB="1201100154e108101e041840b4ed010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000840)={0x40, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create1-mkdirat-mount-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-sendmsg$IPSET_CMD_ADD
detailed listing:
executing program 0:
epoll_create1(0x80000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="60000000020601080000000000000000000000010500010006000000050005000200000005000400000000000900020073797a3100000000140007800800064000000003080013400000040511000300686173683a6970"], 0x60}}, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-setreuid-fchown-sendmsg$NL80211_CMD_CONNECT
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
setreuid(0x0, 0xee00)
fchown(r0, 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-bind$inet-setsockopt$inet_int-ioctl$KDGKBENT-syz_emit_ethernet-recvmmsg
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_MSRS-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_MSRS-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-bind$inet-setsockopt$inet_int-ioctl$KDGKBENT-syz_emit_ethernet-recvmmsg
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 44 programs with base timeout 30s
testing program (duration=41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000a80)={0x1, &(0x7f0000000ac0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]})
close_range(r0, 0xffffffffffffffff, 0x0)
openat$ptp0(0xffffffffffffff9c, &(0x7f0000000b00), 0x0, 0x0)
clock_gettime(0xfffffffffffffffb, 0x0)
executing program 0:
r0 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r0, &(0x7f0000000200)={0xa, 0xf3, 0x14, @mcast1, 0x9}, 0x1c)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000280)=0x655e, 0x4)
r1 = dup2(r0, r0)
write$tun(r1, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x46)
recvmmsg(r1, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0}, 0x3ff}], 0x1, 0x2000, 0x0)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x4, 0x6, 0xbaa}, 0x48)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0), 0xa7c, r0}, 0x38)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.dequeue\x00', 0x26e1, 0x0)
close(r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240))
ioctl$SIOCSIFHWADDR(r1, 0x8b19, &(0x7f0000000280)={'wlan0\x00', @random="7cf1e97c9e4f"})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0))
ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8)
ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800000000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x0, 0x0)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800004000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x4, 0xfffffffd)
executing program 1:
setns(0xc9, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2)
ftruncate(r1, 0xffff)
fcntl$addseals(r1, 0x409, 0x3)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r1, 0x1, 0x0, 0x2000})
ioctl$DMA_BUF_SET_NAME_A(r2, 0x40046201, &(0x7f0000000140)='log\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/video4linux/video0/dev_debug\x00', 0x1, 0x0)
write(r0, &(0x7f0000000640)='3', 0x1)
r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0)
ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f00000006c0)={0x9d0000, 0x5, 0x8, r0, 0x0, &(0x7f0000000700)={0x98090d, 0x9, '\x00', @value64=0x1000000005a9}})
executing program 1:
mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b)
mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0)
mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x10454ca, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 32:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 33:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42040, 0x1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x12, r1, 0xc76ed000)
write(r0, &(0x7f0000000040)='an0m', 0x4)
executing program 3:
syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000040)='./file0\x00', 0x10000, &(0x7f0000000500)=ANY=[@ANYBLOB='nodots,showexec,dots,uid=', @ANYRESHEX=0xee00, @ANYBLOB=',check=normal,fmask=00000000000000000000002,sys_immutable,nodots,dots,nodots,nodots,nodots,fmask=00000000000000000177777,dots,quiet,nodots,nodots,check=relaxed,nodots,umask=00000000000000000076645,nodots,nodots,nfs=stale_rw,nodots,smackfsfloor=fmask,defcontext=unconfined_u,permit_directio,permit_directio,fscontext=staff_u,seclabel,euid>', @ANYBLOB="d323af6398d3b2b874d0760a23d467e0d7c5d5634e8c9dd180fb63defedeadbb6af1511ca99e46c631ff309fa72029dcdfd71bd42701db94658176f5a257c6555a5f53e4a1353909ef82738bc1dbe41abf0cabc79f71f86de9e642004bf455d93677ffb0377cd64bd841c62781cfdccc2d82b0f667f567e9689ce23dbfe5d99b53b81f0d8529449c6aa6da4d27ec95856e4dcff1b7d5202f8c2bb424425714694f46b3e5f20f4527ab00cf9097f9e8cdf49586734ba8c6d6986ec2357061559834bbd34aba8fb625343ee6168ecb4cd70cb1130d456c1af6966385b23f5818ed588294ca4eec3a202de54a93df5ed982fcd5cc626b39fe94cc39382532f603d712e78e440f9b19400d72d35034a30eff3a778ab8fdbbef8c31de21aa1428aa62b36e244ce07f49fef3272a0d819de933f6a9ed3ec053b0cdf3e77fd4178be01fc60c792d678b12b21546cd78876bbb78882c4296f7e0c3ee18c418a3a839ecaf6f52a42d66255790f1530fda7e2373f0108a06c5f0c83a6038ec2376a3043c34d5c4e23c45d10c4bec371f9b29012870cf4447bfb4d88425354677df9421caf2027ab2195d0604c4c8bdc0e1d8c551686cb44e487fa7ed9587120b5fc4c693d1b2f043026526e9aa5e98e31c206e69d1d871917a7d7e83653e5fd145f9d03e64f96b92ca83032072d8a7b53088d9a545a554cde2d383012f2b4bc74eaa3e630d944d58f0eb79a291493fa05dc69be36b144e5c5e4dc85463d4b6a4ada2f8b123b9d0f9120c4a7c3c8f1ab81af58836b0abfa63da805d27e1759d331fb5e8cdcdedf88a5446103ba1de1f3cddaebcb1583d0350c2967f63b00641adc704e9648f9c3790da6aa99838be8fce3c780f19c47444b6f3ba03f7d78b54310db92bdedde162a6af64368e6b60698bca97cde01c0bf198093d216571cd632cc1f2ef5682d02329e9f5eee174a7a9d239ba793c89fead42518b5574edab0bbe0cd62e9e88df6b6485c456f2c6d64e3a8c2ea093c15462e6abf7cc0f524740d6a302fa09bd89f77f16a4c11aed0c19acf8318e56adb2c95c499fa432ac9e8cccf7879d43f58c5839bff218aaac2ffadb5f47920b57a31ac0a499b2503b000b7410be1c341726e89916ee03ed88a2bacc3379efd0bed4cdde3e7f264112a014ccf7720d768f3240c4b1c7ba7e54c6c031127e8e6bc9a2b95bf58d45a507db17446fd4b293c33fcc475f5eafc07022da92e16b12e99e0626f08d965a35ca16df3ae3642271cc33999197720402eaffb661b2aba25fd486cea0660215048253df3da35577eca728851e009550d37ab89bdbb42cae68dfaf13ba20c9b9dcfa38c04c7a72a728abdca2daa877e3e66541bbe63c2f491faf13e631554efeb72bb2fac5de916bd56885369f2c7c0418fc8a66dcffa52a6bd902d1b733ee28e7503484f8411afc80582864e3b950a369fb6a5e6da5bdd906afa9daa1b967e0ae32bf3b5aa025da64be47e61c25ca825cafd3e428957e28ed0c89b762169472692ce874ffc504b853ca29669761429f991aba554555d117521be3ff239835c8eaaa9f8e0edb51e19cff17fba9466f30d6ee477b740a0ab71da8119c2a9527b2139426c78834da1c35a26eff38fcd81296c5e4cff92f6c9bd21dc6967312f499e5788833d5179b78704ccd1123e7773eb7e2a18fbdec5f06d02aaa7848b57ff801dabc6662df9e903d04173fed24c961f29b8a07fcc58a8b6b9df0939595ac6ebb72ba72c89f680e260011b995958cdd6a17943ec45cab7287e0591e40dc4de176e65fb727cfeffbad3cfc2bbaad22d09d8ef907beb2ba56867f066ab66e0fc4911407286b44d45c61e51b0e6065105aa68581f9c88940b99cb9212e9114f2dad5a4f0aa872a8f88e5770308cd06d7af5f7645946d31545a66069386b03706754c37a7874dccf2150cdf741dbf15b1e0751aa57bed556e5c383f1ad89f42f9c06bd6fabb8c33263fcf4391aab21999143bb54ff3fa0124abda0a704c3eb8231a2536dab0c76c3ce32b055d8b483bcc73eeab38b94653a5064213052806b02c1c4692f9e6ff929ef3ca0ff6f2d8a664406823b44e48cef2872e442b07cd847eff2c087ac4eb61e7fb589f36812a0899af59ba281c247342c7e3adcfb22098ab905fbef7d1e11ad49819b066781ed52d215c2e813b6b547d58db5c4fb74b8466ffcad54f4581315ae3016221e1122e52f629d2d0ed649a8df30b74cb4c64af64c785597f46d759f4152121f0c05b0e190ad75f0acca92c55fb62e749bb3bbb2fbfff94fa3dd6872dd5b38e6a764000da6f71b696152c0aa6f8c5b6b915d627f65f123455ff1c1330d31b802637fd6ac5556f3fba22510b5b144b58faf3c0478b024123294fb8feb97875047007ae8157bd34e08c1f0699838ffe0e0481247d03b61d8e39469597344106590faf6f76e1030b8d0e6ef10a49bc9cdbac2187ff5878d58feb3c8322ea282a9d446404a69715c410d874f358fcba191f35aa941fa17e27e2edfe33c0ecb314b0bef29a98d76273014eb5be4121a4c3c329ae2d9ece2efb1894e41b0ae4bb5cf29c3ddb14e5589a54dd4c0b0bbdc680f2f6b776bf9c0d68e444988dcda9b4f41d2e61e2f18ccfdf199844a383cb7bf67b3f309da8ef8ff13717329b992803375f1203685e8bcd4df89bb8f091deb354baf921e550c46c8478de0159006707dee0c41a7be6819ce4942e1d885ccccc8c3cafb84bf0459bfa5fe9424de093418c4f60c7fa98f7eb7886b897800d59207e088b213eb4f6a3f4db67daecf8ae906e732bc497d55d78d1c20a279b04f36d812031aef268364cda05499aa1184919ff2d865e3b2014942e2582e53ea8cdc5329ae9831c28c0bc4c9fc19fe12f3b27c077aa7ee56093902a5f9c3351d9c72fc61ad9c5a3c6b51df46ce84d485d34ebb4b9b5015492de3751b067dcb20e92130087fa69c15a1411611519c8adf2071565b77420bf0f6ef5c79000690ccf948c61c4cf4ffa8d81ec8dd7eb7a5e771be42b5cf35d06caca4cbd7272828619f1045f86165e87cf5d56a39d3e1de94b74e016759b0c4f3746ee3f5465439ce6f4737caa2d29cae0ae07f664da05767d72eeed7dfc0ac665fb1cfb042b936fa3dbf629d50a9c832a57f68073c48e1eaee20daee97ecb21192467598bf093e492f17346288902eb8d3570ad26c2263accd80feea8572f19b8bea68b95289aa5fd2d9471fa2046a6c62355b758743be4f82042caa3a2980473e5f59dd9bfc73864be3a36c4f8cefce917b01e64a532ca861bcd88d6c9483c85cac0ab03dbd9579119d0c760db3d00ad0ab3c63cedeaff9d36bcb045ecfe0f586fd92239890c20aaad20349b610840618e95d8b58f342af983a83d20b76ae7d1f0f4eedc8daabb801bdea8550a21fbd4f8c66452578e8d6ad54ef6fcc3f2726d28f7ab80e94929a611f5d20c2d11cbeb44aed284edf210469ae890ab0c0f1a57af8d218ea87d8942f8696a2dad99b3b6f4ec531237c72c98a613553bd972fa0ff7a5ee1c2cb51ffc6137c7a80a631be586a8df388c49944c9ad0540b4204e86d2a1a04db434a830798654b9d61a3205e53b80575d7767b393fb9e3d1c21bdf9db29cdc6feff5483d189f4b55c4e04cfa17dad004b3abc0e7f52cad62898fa45a61e873298b4136bef49deeba85bcb172d1a4c6f49d7df1a0aa18fd4dbe165e144139d949222c93cc6369579ac80827d015bc78e3d96a3c5bd26d98df194769d3f1b8f474e9e10df1284ac316e55b309cefe561d629d507f06ccf985e565fb3da0b4a76cc2e099c1f7dd5d6f065854c877f890cc449973c31bc76ac462dec2039e10c3fd3eefac2a5d2fcac60fa069d9c443d650c0807f5a52624c65d8bb4647d02b15fc694bde11e9c06996b99614157669b422d39150094dd78ad62b45a9b62d4c5fd447b293088bf177b81340de59674217edfe1bac8f6f586e248a828081b7a4ebd3108471a572f688fee6e45463794320fa1fe0ea42b4ac788ca20e5fa71617065c198983eb25b3b543664751ddacb0f0f354fc60d0fcde34546ea9e7570195d3aef8f437b1e341c121e9465dd816af8914e840624b30f2d0cf932cc7c0cc5b29537ab12cffb95093290ae16308184101c9aa6b36828beb1208d5f21e0fb5d9ae83db0806720c1332f739b560cbe8ed28764b62ea7d3db2e1bc2ef75ddbc60a2c396d16a42ea52f0120e4e6d4daecebac1ce0718f3454d101c64cae2d88d913219f2b7c4871083cf79d17e86885c436704b6542228b66c92035d5d0ccf6a4f111c2c7663bc1189af84da738046df10a64aea378c6fca7050c287914f64952495af275d6afcc05f5fb390e25bdefc08ce60f4f935dfc16a85a4696068543edc824e3b561d0a06621170932d3ccb801a41a9f10b2ce4d882af46973b4de248f4cfeb5380d3cda6741980a7e90bfcc9291fd211650a7cbad818edd43a74028f1d47688044cd443d535a82d1da7fc793e696b648e36bfac427436cbc205270926af839a8dbdd725cc5ad6ca5491194b2a0238f85baa1211239bf81ee89f96b4df7671ba9914afb0a3c33c8e3ca1745f278d8859d010dc61457eacf2b56b8413f67c32eaaaf14091b8f112602bffb7ec872f20943c8beb4f3e01c2dcf30326194a6ba3332c0f141a68c428368e2aa944ef35cd665c3b394788836f6b2c694b928ec507a38e4f93142c71db1bd8e2eeba8d389a2b82e520f23e526bd3f4446d9e1ae6794f5b2da537bc803f03ecaa2c0bbd91fb0885156b1e77e0f7324eec99ea0461786241b3bb4a4f0fd317ba521e4576973afcc0e48c9c32c576229cff2267717e651db598061ac2368065b1a80ab97c22de8668ee8f98f05db24a2b7d4f029034c574ee0211d55007c7ad1313d2c3ca1792e896ee9ec40400bf35643bf81ae10da131ec935c0562e4cdd1554677bd54588b5a0b0b5fd0a37482cfab046230aa50e1030afd1085b1e8a7b7d428639c64f845dd45e173dc8ccaf9e86249ff7dc625a30b9c42fdf75271090c9263cf0ef662e1fea6067c41dd4a70573debf66f4f1b7f3a8cf069de7699a454420144388e2ae1f8150d83f7f52e3817c9f66bc7cdbed7c597db66393f35ff73cc6cda31d49b21ee817da91c00ecb614e4b9a0c10ccf54c26ec0e683b9703eae7a534a8af479002bdb18a0625f4b284c2cb09b608ec189a0c370a092922e0e74484aeef2f4578db4a103841cb31c7d167c46fbe881911693e8399ee5ba0756f52df83550a6aad3d637ac4fa9f054714b61e1485210b8cccae5c3c8f6059c0b2dc614088aacde3ec782845f0996e1c21188a57f6991cad09f96ef5f35065b919077977da0aa15b56f49ca996309f8a469bd0b318a3be892d39b1d17403753955e897b95297fff2e0ea5be5411935a8ff1ac29189e75682d7b0345b7100509c8ad08a23b2dfcd7654f4b5951af4d238c69bfd6154ab4b1058cf9659f3ce9079e640771e2e2f6fe430451831aa43b0202f276e276149d87ce5ded959801d03913443f8dfe8006ca35a10d98186f1718db5b17c5e5c9500c1c9e6b7e2cccd43a57012f1b6b28a928fd1c95f462eef4fe01f2b8b5d909d97d96e8d2564b309cf22059c0a852a97a8ca99ba9535816d6b149a5d1b7e239c21f1d1589e2f68ea9d36c3bad7026bee94bb59daf725ffbcb7bbe982cf88b89f911ebe45f98af2130175783c9836eeb8c6051398e16784f82c8a5cd1db6aa1de56f9aa3715b9ff96ad195b78d9fcefba1cec129c239d11b40e688f99", @ANYRES64=0x0], 0x1, 0x1f5, &(0x7f0000000300)="$eJzs3cFqE1EUANCbmCYTcdGdIAgjLnRV1C+oSAUxIFSy0J2gK7NqN6mb9jP8Bf/LD5CuspEncSadmKYxBDKj7Tmb3pn7Xt+7M2SSTW5SFL7f/RpZ1or2fuzHpBW70Y6ZswAArpNJSvEjFZreCwBQjzXe/3/WvCUAYMvevnv/+vlgcHCY51nE+dl4OB4Wf4v8y1eDgyf5b7vVrPPxeHjrIv80X/zsMM3vxO0y/6yYn1+kuxEx7Mbjh0V+mnvxZpD/Ob8XH7dcOwAAAAAAAAAAAAAAAAAAAAAANOV+5DNL+/vs7S3m+2W+OJrrD7TQv6cT9zrlYdUeKJ3WURQAAAAAAAAAAAAAAAAAAAD8Z45Pvnz+MBp9OqqCXkTMn+ksGXN10Cr/8VqDmw/asdn0flnmBou2yku03QL7y2/uOkF0/pW7s2mQ17BWf+XlTWkaLH8VzNpiXDm9GxGrV390uOnmJyml0bcHR8cnkVYOrp4RvVqfSAAAAAAAAAAAAAAAAAAAcHPNfev7kqyJDQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAA6rf/58Gl8+sDE4j4k78dfBsrZ3IGq0VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA6+tXAAAA//85ziI4")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
fcntl$notify(r0, 0x402, 0x30)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xae)
write(0xffffffffffffffff, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(r1, 0x40047211, &(0x7f0000000100))
executing program 5:
io_setup(0x2278, &(0x7f0000000180)=<r0=>0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000040)={0x77359400}, 0x10)
io_submit(r0, 0x1, &(0x7f0000000140)=[&(0x7f00000001c0)={0x0, 0x4, 0x0, 0x0, 0x0, r1, &(0x7f0000000440)='5', 0x1, 0x0, 0x0, 0x2}])
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]})
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x58, 0x2c, 0xd3f, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0x0, 0x9}, {0x10}}, [@filter_kind_options=@f_flower={{0x24}, {0x28, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x6006}, @TCA_FLOWER_KEY_IPV4_DST={0x8, 0xc, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_FLOWER_KEY_ENC_IPV6_SRC={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x4080)
executing program 3:
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_mount_image$exfat(&(0x7f0000000040), &(0x7f0000000080)='./file2\x00', 0x80, &(0x7f00000000c0)=ANY=[], 0x7d, 0x1508, &(0x7f0000000400)="$eJzs3Au0TlXXOPA511qb4+TyJLnvuebmSS6LJAklySVJkpDcE5IkSZLEIbckJCHXk+Qeck8nHff7Jfekk1eSJCEhyfqP0+Xv6633873v1/f3/r8zf2OscdY8e8211zpzPOfZe4/xPF93HVa9UY0q9ZkZ/hX6tw7+8iMJABIAYCAA5ACAAADK5iybM/14Fo1J/9JJxP+QBjOu9ArElST1z9ik/hmb1D9jk/pnbFL/jE3qn7FJ/TM2qb8QGdqsfFdLy7hNnv//f079d5Ll/T9DwH90QOr/v43+p0ZL/TM2qX/GJvXP2KT+GVlwpRcgrjB5/WdsUn8hMrS//JnyhnNX+pm2tH+iCSGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ/w+c85cYAPit/4eBCVdkeUIIIYQQQgghhPgL+Hev9AqEEEIIIYQQQgjxPw9BgQYDAWSCzJAAWSARroKskA2yQw6IwdWQE66BXHAt5IY8kBfyQX4oAAUhBAILDBEUgsIQh+ugCFwPRaEYFIcS4KAklIIboDTcCGXgJigLN0M5uAXKQ4Wfz5nudqgMd0AVuBOqQjWoDjXgLqgJd0MtuAdqw71QB+6DunA/1IMHoD40gIbwIDSCh6AxNIGm0AyaQwtoeZn85Bx/lv889IAXoCf0giToDX3gRegL/aA/DICB8BIMgpdhMLwCQ2AoDINXYTi8BiPgdRgJo2A0vAFjYCyMg/EwASZCMrwJk+AtmAxvP5QNpsI0mA4zYCbMgndgNsyBufAuzIP5sACSsyyCxbAE3oOl8D6kwAewDD6EVFgOK2AlrILVsAbWwjpYDxtgI2yCzbAFtsI2+Ai2ww7YCbtgN+yBvfAx7INPYD98Cmn42T+Zf/b3+dANAQEVKjRoMBNmwgRMwERMxKyYFbNjdoxhDHNiTsyFuTA35sa8mBeTMD8WxIJISMjIWAgLYRzjWASLYFEsisWxODp0WApLYWm8EctgGSyLZbEclsPyWAEr4K14K1bCSlgZK2MVrIJVsSpWx+p4F96Fd2MtrIW1sTbWwTpYF+tiPayH9bE+NsSG2AgbYWNsjE2xKTbH5tgSW2IrbIWtsTW2xbbYDtthe2yPHbADdsSO2Ak7YWfsjF2wC3bFrtgNn8Pn8Hl8Hl/AF7AXVlW9sQ/2wb7YF/vjAByAL+EgfBlfxldwCA7FYfgqvoqv4Qg8gyNxFI7G0VhJjcVxOB5ZTcRkTMbMMAkn42ScglNxKk7HGTgTZ+EsnI1zcA6+i/NwPs7HhbgQF+MSXIJL8X1MwRRchmcxFZfjClyJq3A1rsK1uA7X4gbciBtwM27GrbgVP8KPcAfuwF24C/fgHvwYP8ZP8BMcgmmYhgfwAB7Eg3gID+FhPIxH8AgexaN4DI/hcTyOJ/AknsKTeBpP4xk8i+cA4Dyexwt4AS/ixfQXv0pnlFGZVCaVoBJUokpUWVVWlV1lVzEVUzlVTpVL5VK5VW6VV+VV+VV+VVAVVKRIsYpUIVVIxVVcFVFFVFFVVBVXxZVTTpVSpVRpVVqVUWVUWXWzKqduUeVVBdXG3apuVZVUW1dZ3aGqqCqqqqqmqqsaqoaqqWqqWqqWqq1qqzqqjqqr7lf1VG/sjw1UemUaqaHYWA3DpqqZaq5aqNfwYdVKjcDWqo1qqx5Vo3AktletXAf1hOqoxmEn9ZQaj0+rLmoidlXPqm7qOdVdPa96qNaup+qlpmBv1UdNx76qn+qvBqjZWE2lV6y6ekU9n3moGqZeVYvxNTVCva5GqlFqtHpDjVFj1Tg1Xk1QE1WyelNNUm+pyeptNUVNVdPUdDVDzVSz1Dtqtpqj5qp31Tw1Xy1QC9UitVgtUe+ppUqrFPWBWqY+VKlquVqhVqpVarVao9aqdWq92qA2qk1qs9qitqpt6iO1Xe1QO9UutVvtUXvVx2qf+kTtV5+qNPWZOqD+pg6qz9Uh9YU6rL5UR9RX6qj6Wh1T36jj6lt1Qp1Up9R36rT6Xp1RZ9U59YM6r35UF9RP6qLyCjRqpbU2OtCZdGadoLPoRH2Vzqqz6ew6h47pq3VOfY3Opa/VuXUendfk0/l1AV1Qh5q01awjXUgX1nF9nS6ir9dFdTFdXJfQTpfUpfQNurS+UZfRN+my+mZdTt+iy+sKuqIHfZuupG/XlfUduoq+U1fV1XR1XUPfpWvqu3UtfY+ure/VdfR9uq6+X9fTD+j6uoFuqB/UjfRDurFuopvqZrq5bqFb6od1K/2Ibq3b6Lb6Ud1OP6bb68d1B/2E7qif1J30U7qzflp30c/orvpZ3U0/p7vrn/RF7XVP3Usn6d66j35R99X9dH89QA/UL+lB+mU9WL+ih+iheph+VQ/Xr+kR+nU9Uo/So/Ubeoweq8fp8XqCnqiT9Zt6kn5LT9Zv6yl6qp6mp+sZeqbu/+tMc/8L+W/9Sf7gn8++VW/TH+nteofeqXfp3XqP3qv36n16n96v9+s0naYP6AP6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+iT+gf9nT6tv9dn9Fl9Vv+gz+vz+sKvfwMwaJTRxpjAZDKZTYLJYhLNVSaryWaymxwmZq42Oc01Jpe51uQ2eUxek8/kNwVMQRMaMtawiUwhU9jEzXWmiLneFDXFTHFTwjhT0pQyN/y38y+3vpampWllWpnWprVpa9qadqadaW/amw6mg+loOppOppPpbDqbLqaL6Wq6mm6mm+luupsepofpaXqaJJNk+pgXTV/Tz/Q3A8xA85IZZAaZwWawGWKGmGFmmBluhpsRZoQZaUaa0Wa0GWPGmHFmnJlgJphkn8NMMpPMZDPZTDFTzLSBOcwMM8PMMrPMbDPbzDVzzTwzzywwC8wis8gsMUvMUrPUpJgUs8wsM6lmuVluVpqVZrVZbdaatWa9WW82mo1ms9lsUs02s81sN9vNTrPT7Da7zV6z1+wz+8x+s9+kmTRzwBwwB81Bc8gcMofNYXPEHDFHzVFzzBwzx81xc8KcMKfMKXPanDZnzBlzzpwz5815c8FcMBfNxfTLvkAFKjCBCTIFmYKEICFIDBKDrEHWIHuQPYgFsSBnkDPIFVwb5A7yBHmDfEH+oEBQMAgDCmzAQRQUCgoH8eC6oEhwfVA0KBYUD0oELigZlApuCEoHNwZlgpuCssHNQbnglqB8UCGoGNwa3BZUCm4PKgd3BFWCO4OqQbWgelAjuCuoGdwd1AruCWoH9wZ1gvuCusH9Qb3ggaB+0CBoGDwYNAoeChoHTYKmQbOgedAiaPmXzu/9mTyPuJ5hrzAp7B32CV8M+4b9wv7hgHBg+FI4KHw5HBy+Eg4Jh4bDwlfD4eFr4Yjw9XBkOCocHb4RjgnHhuPC8eGEcGKYHL4ZTgrfCieHb4dTwqnhtGB6OCOcGc4K3wlnh3PCueG74bxwfrggXBguCheH+MslMaSEH4TLwg/D1HB5uCJcGa4KV4drwrXhunB9uCHcGG4KN5cd9MvQcHu4I9wZ7gp3h3vCveHH4b7wk3B/+GmYFn4WHgj/Fh4MPw8PhV+Eh8MvwyPhV+HR8OvwWPhNeDz8NjwRngxPhd+Fp8PvwzPh2fBc+EN4PvwxvBD+FF4MffrFffrbOxkylIkyUQIlUCIlUlbKStkpO8UoRjkpJ+WiXJSbclNeykv5KT8VpIKUjompEBWiOMWpCBWholSUilNxcuSoFJWi0lSaylAZKktlqRyVo/JUnipSRbqNbqPb6Xa6g+6gO+lOqkbVqAbVoJpUk2pRLapNtakO1aG6VJfqUT2qT/WpITWkRtSIGlNjakpNqTk1p5bUklpRK2pNrakttaV21I7aU3vqQB2oI3WkTtSJOlNn6kJdqCt1pW7UjbpTd+pBPagn9aQkSqI+1If6Ul/qT/1pIA2kQTSIBtNgGkJDaBgNo+E0nEbQCBpJo2g0vUFjaCyNo/E0gSZSMiXTJJpEk2kyTaEpNI2m0QyaQbNoFs2m2TSX5tI8mkcLaAEtokW0hJbQUlpKKZRCy2gZpVIqraAVtIpW0RpaQ+toHW2gDbSJNtEW2kLbaBttp+20k3bSbtpNe2kv7aN9tJ/2Uxql0QE6QAfpIB2iQ3SYDtMROkJH6Sgdo2N0nI7TCTpBp+gUnabTdIbO0Dk6R+fpR7pAP9FF8pRgs9hEe5XNarPZ7DaH/fs4r81n89sCtqANbW6b53cxWWuL2mK2uC1hnS1pS9kb/hCXtxVsRXurvc1Wsrfbyra8zQL/Ma5p77a17D22tr3X1rB3/S6uY++zde1Dtp5tYuvbZrahbWEb2YdsY9vENrXNbHPbwrazj9n29nHbwT5hO9on/xAvte/bdXa93WA32n32E3vO/mCP2q/tefuj7Wl72YH2JTvIvmwH21fsEDv09zGAHW3fsGPsWDvOjrcT7MQ/xNPsdDvDzrSz7Dt2tp3zh3iJfc/Osyl2gV1oF9nFP8fpa0qxH9hl9kObapfbFXalXWVX2zV27f9d60q72W6xW+1e+7HdbnfYnXaX3W33/Byn72O//dSm2c/sEfuVPWg/t4fsMXvYfvlznL6/Y/Ybe9x+a0/Yk/aU/c6ett/bM/bsz/tP3/t39id70XoLjKxYs+GAM3FmTuAsnMhXcVbOxtk5B8f4as7J13AuvpZzcx7Oy/k4PxfgghwysWXmiAtxYY7zdVyEr+eiXIyLcwl2XJJL8Q1cmm/kMnwTl+WbuRzfwuW5AlfkW/k2rsS3c2W+g6vwnVyVq3F1rsF3cU2+m2vxPVyb7+U6fB/X5fu5Hj/A9bkBN+QHuRE/xI25CTflZtycW3BLfphb8SPcmttwW36U2/Fj3J4f5w78BHfkJ7kTP8Wd+Wnuws9wV36Wu/Fz3J2f5x78AvfkXpzEvbkPv8h9uR/35wE8kF/iQfwyD+ZXeAgP5WH8Kg/n13gEv84jeRSP5jd4DI/lcTyeJ/BETuY3eRK/xZP5bZ7CU3kaT+cZPJNn8Ts8m+fwXH6X5/F8XsALeREv5iX8Hi/l9zmFP+Bl/CGn8nJewSt5Fa/mNbyW1/F63sAbeRNv5i28lbfxR7ydd/BO3sW7eQ/v5Y95H3/C+/lTTuPP+AD/jQ/y53yIv+DD/CUf4a/4KH/Nx/gbPs7f8gk+yaf4Oz7N3/MZPsvn+Ac+zz/yBf6JL7JniDBSkY5MFESZosxRQpQlSoyuirJG2aLsUY4oFl0d5YyuiXJF10a5ozxR3ihflD8qEBWMwogiG3EURYWiwlE8ui4qEl0fFY2KRcWjEpGLSkalohui0tGNUZnopqhsdHNULrolKh9ViCpGt0a3RZWi26PK0R1RlejOqGpULaoe1YjuimpGd0e1onui2tG9UZnovqhudH9UL3ogqh81iBpGD0aNooeixlGTqGnULGoetYhaRg9HraJHotZRm6ht9GjULnosah89HnWInog6Rk9eOl4s+OXd9O+OJ0W9I/3rE7J79KL44viS+HvxpfH34ynxD+LL4h/GU+PL4yviK+Or4qvja+Jr4+vi6+Mb4hvjm+Kb41viW+Pe18gMDtNvhMG4wGVymV2Cy+IS3VUuq8vmsrscLuaudjndNS6Xu9bldnlcXpfP5XcFXEEXOnLWsYtcIVfYxd11roi73hV1xVxxV8I5V9KVci1cS9fStXKPuNaujWvrHnWPusfcY+7x3z6r4zq5p1xn97Tr4p5xz7hnXTf3nOvunnc93Auup+vlklyS6+P6uL6ur+vv+ruBbqAb5Aa5wW6wG+KGuGFumBvuhrsRboQb6Ua60W60G+PGuHFunJvgJrhkl+wmuUluspvsprgpbpqb5ma4GW6Wm+Vmu9lurpvr5rl5boFb4Ba5RW6JW+KWuqUuxaW4ZW6ZS3WpboVb4Va5VW6NW+PWuXVug9vgNrlNbovb4ra5bW672+52up1ut9vt9rq9bp/b5/a7/S7NpbkD7oA76A66Q+4Ld9h96Y64r9xR97U75r5xx9237oQ76U45r0+7790Zd9adcz+48+5Hd8H95C4675Jjb8Ymxd6KTY69HZsSmxqbFpsemxGbGZsVeyc2OzYnNjf2bmxebH5sQWxhbFFscWxJ7L3Y0tj7sZTYB7FlsQ9jqbHlsRWxlbFVsdUx7wtsj3whX9jH/XW+iL/eF/XFfHFfwjtf0pfyN/jS/kZfxt/ky/qbfTl/iy/vK/iKvolv6pv55r6Fb+kf9q38I761b+Pb+kd9O/+Yb+8f9x38E76jf9J38k/5zv5p38U/47v6Z+f/WmXfw7/ge/pePsn39n38i76v7+f7+wF+oH/JD/Iv+8H+FT/ED/XD/Kt+uH/Nj/Cv+5F+lB/t3/Bj/Fg/zo/3E/xEn+zf9JP8W36yf9tP8VP9ND/dz/Az/Sz/jp/t5/i5/l0/z8/3C/xCv8gv9kv8e36pf9+n+A/8Mv+hT/XL/Qq/0q/yq/0av9av8+v9Br/Rb/Kb/Ra/1W/zH/ntfoff6Xf53X6P3+s/9vv8J36//9Sn+c/8Af83f9B/7g/5L/xh/6U/4r/yR/3X/pj/xh/33/oT/qQ/5b/zp/33/ow/68/5H/x5/6O/4H/yF//sM2tCCCGEEOIP9GWO9/6T36lfW7o+AJBtR77Dfz/npty/9PupfR1jAPBEr64NfmsNGiQlJf06NlVDUHghAMQu5f/8/QO/xsuhLTwGHaANlP7T9fVTFX++7vvP5o/fDJAIkOW3nPTbo0T4+/lv/AfzN3mPLzf/QoCihS/lpJ/ot/jS/GX+wfx72l1m/iyfJwO0/g85WeFSfGn+UvAIPAkdfjdSCCGEEEIIIYT4RT91vtvl7m/T78/zm0s5meFSfLn788uo/FfsQQghhBBCCCGEEP+5p5/r/vjDHTq06fy/uZP532MZ/wYdBIB/g2VI59+/c6X/MwkhhBBCCCH+apcu+q/0SoQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiIzrX/+GMPVfHnyl9yiEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEJcaf8nAAD//8jaVSM=")
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0)
r0 = open(&(0x7f0000001980)='./file1\x00', 0x14e142, 0x90)
pwritev2(r0, &(0x7f00000019c0)=[{&(0x7f0000001a00)="85", 0x140000}], 0xf, 0x7000, 0x0, 0x3)
executing program 4:
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r3, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/video4linux/video0/dev_debug\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='3', 0x1)
r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000240)={0x0, 0x1, 0xffffffff, r0, 0x0, &(0x7f0000000140)={0x9a091c, 0x7, '\x00', @p_u32=0x0}})
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x48241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000240)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
write$tun(r0, &(0x7f0000000840)={@val={0x0, 0x6003}, @void, @eth={@local, @empty, @val={@void, {0x8100, 0x0, 0x1, 0x3}}, {@ipv6={0x86dd, @generic={0x1, 0x6, '\x00\a\x00', 0x18, 0x2b, 0x0, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {[@routing={0x4, 0x0, 0x0, 0x5}, @dstopts={0x6}, @hopopts]}}}}}}, 0x56)
executing program 6:
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c, &(0x7f0000000140)=[{&(0x7f00000001c0)='`', 0x1}], 0x1, &(0x7f0000000240)=ANY=[@ANYBLOB="480000000000000029000000370000002b0500000000000007280000000308480400030000000000000008000000000000000104000000000000080000000000000004010300000014000000000000002900000043000000080000000000000050"], 0xb0}}], 0x1, 0x4000801)
mkdirat(0xffffffffffffff9c, &(0x7f00000013c0)='./proc_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000001400)='./proc_mnt\x00', &(0x7f0000001440)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000001480)='./proc_mnt/net/sctp/assocs\x00', 0x0, 0x0)
read$rfkill(r1, &(0x7f00000014c0), 0xfffffcfe)
executing program 5:
r0 = socket(0x10, 0x803, 0x0)
r1 = socket(0xa, 0x3, 0x87)
r2 = socket(0xa, 0x3, 0x87)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000840)={'veth1_macvtap\x00', <r3=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000880)={@local, 0x40, r3})
sendmsg$nl_route(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbfd, {0xa, 0x3f, 0x0, 0xc8, r3}, [@IFA_FLAGS={0x8, 0x8, 0x582}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c040}, 0x8000)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x300f401, 0x0, 0x2, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
chdir(&(0x7f00000003c0)='./bus\x00')
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='io.stat\x00', 0x275a, 0x0)
write$P9_RLERRORu(r0, 0x0, 0x14)
executing program 3:
syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000000)='./file0\x00', 0x180c8, &(0x7f00000006c0)=ANY=[@ANYBLOB="6e66732c646f74732c636865636b3d7374726963742c646f74732c6572726f72733d72656d6f756e742d726f2c00f8403bb14281bbfb9b8213bd6284536d64789a24dd73b98b3e33cb47fed8a7364664b62e9e891aa832722dfc28bfa4489b3a127a503e72326b737d0f67c97be6f37ef46154dec39ef8718946ffc8cd4d735a0b101c1722477bbe2f923577ea51f7116f17c3ddf5c497fba2d0bb3272d123b31e9461d4e2d65a42e1174fa269de92e463fc1cde2367bdb50cc5b2b462e1d45fc3265f1a88561ab6afb1b73a3b340b5c73055fc6e601843a59f3cdeb36991cfa985453287d4c9d2d6e21adddc57a607369c682e821b20dc0efd51d12f386f3f8e53c05e696e50c7c3f79b1b0bd7e5cfaf3f63d8949c8dd2fd94aa0f259a4cb9412c30c45f9d4d63d267d2a43f03a47fa56b3000000f9ffffffffffffff000000"], 0x9, 0x250, &(0x7f0000000300)="$eJzs3cFqE0EYB/DPJG1jL/YsHha8eArqyWuQCmJAiOSgJwPVSyvC9rJ62sfwGXwkH6On3lbaXZq2xl50M+3u7wdhPvgTZgZCJodvsh8ffTk8+Hr8ufr1I8bjLEYRZVVF7MUghlG714yD83o7LisDALhr5vPlNPUaaFeeT5dbEbHzR7L4mWRBAAAAAAAAAAAA/LN1/f9xqv8fALpM/38XDG9M83y63G1+v12l/x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABI57SqHlQ3vFKvDwD4/5z/ANA/zn8A6B/nPwD0z7v3H95MZ7P9eZaNI07KYlEs6rHOX72e7T/Nzu2t3nVSFIvhRf6szrOr+VbsNvnztfl2PHlc52fZy7eza/lOHLS/fQAAAAAAAAAAAAAAAAAAALgVJtmFtff7J5O/5XV16f8Brt3fH8XD0ca2AQAAAAAAAAAAAAAAAAAAAHfa8bfvh8ujo0+5ojNFvGh9ikHz8bktWz4rIjY+6f1IMOmGisRfTAAAAAAAAAAAAAAAAAAA0EOrS7+pVwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6aye/99eERFlVUu9XQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDDfgcAAP//wzuVuw==")
munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000)
sendto$inet6(0xffffffffffffffff, &(0x7f00000001c0)="a6e2976b5c", 0x5, 0x840, 0x0, 0x0)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2000c850, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_mount_image$fuse(0x0, &(0x7f00000001c0)='./file1\x00', 0x3000408, 0x0, 0x1, 0x0, 0x0)
executing program 6:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, 0x0}], 0x1, 0x41, &(0x7f0000000000)=[@cr4={0x1, 0x408e2}], 0x1)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, &(0x7f0000000080)="400f23280f019c990e000000b91a0200000f32c344240000600000c744240200800000c7442406000000000f011c246566262e440f23b126673e660f382943b0c4c3914984fb499e00007fc744240000000000c744240278581667c74424060000000004011c2467440fc7580066b804008ee8", 0x73}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
pipe2(&(0x7f0000000180)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x84800)
write$P9_RGETLOCK(r2, &(0x7f0000000040)=ANY=[], 0xffffff6a)
pipe2(&(0x7f0000000200)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
tee(r1, r3, 0xfffffffffffffc01, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x5, 0x4, 0x1, 0x8}, 0x50)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000040)={r2}, 0xc)
executing program 4:
socket$inet_tcp(0x2, 0x1, 0x0)
unshare(0x22020600)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={0x2adc0, 0x1c1, 0x6}, 0x18)
r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0)
write$binfmt_register(r0, &(0x7f0000000100)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x46d0, 0x3a, '\xe2\xbf\xd9\xafk\xd3~a3\xd0\x94', 0x3a, 'u', 0x3a, './file0', 0x3a, [0x4f, 0x4f, 0x4f, 0x50, 0x46]}, 0x38)
executing program 6:
prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7)
r0 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x13)
tkill(r0, 0x12)
waitid(0x1, r0, 0x0, 0xb, &(0x7f0000000240))
executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newsa={0x138, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x0, 0x0, 0xd, 0xa, 0x80, 0x80}, {@in6=@loopback, 0x4d2, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@dev={0xac, 0x14, 0x14, 0x19}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x794, 0x4e23, 0x7, 0x0, 0x0, 0x0, 0x3a}, {@in=@broadcast, 0x4d6, 0x6c}, @in6=@dev={0xfe, 0x80, '\x00', 0x36}, {0x3, 0x192, 0x6, 0x2, 0x3, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x3, 0xfffffff9, 0x40}, 0x70bd2a, 0x34fc, 0x2, 0x1, 0xfe, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0)
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
sendto$inet6(r0, &(0x7f0000000380)="4e813cbfba", 0x5, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='highspeed', 0x9)
shutdown(r0, 0x1)
executing program 3:
socket$netlink(0x10, 0x3, 0x0)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='for', 0x3)
executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000780)={0x2b, 0x2b, '\x00', [@padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x8, {0x3, 0x0, 0x79, 0x7}}, @calipso={0x7, 0x48, {0x0, 0x10, 0xc0, 0x1, [0x73, 0x934, 0xfff, 0x5, 0x4, 0x3, 0x1, 0x4]}}, @generic={0xa1, 0x5b, "59cb7288795557ea9b476f3cdb080e63b0687cfaadbe599ac45d6d9071575e05df28a3621a9e375e5d18423e41aafd04bd5c9a63b238058141a021516617cb0bdd08f1e49a8a23412561a9421553c62b7720908b23437f9ca7c336"}, @pad1, @calipso={0x7, 0x10, {0x0, 0x2, 0x51, 0xf, [0xfe]}}, @generic={0x6, 0x87, "9a01485ecac729407a0390fc142e75498f5b3f81a83039a4a1bfaef9e1731bc1400d7af38b66731fc290724a29b93a088fca4ca0fa6e7ca5d52789b8fc1b4288ecac3bdc903f17cc4fc2c7908070b70034f6f8ddfaf7a78eb482c76d46b874faef2ecc3119da102289d7777570b235deb851b9201c076c91eb874b616201d00f0681dfb294ec0e"}]}, 0x160)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000900)={0x200000000000001}, 0x8)
connect$inet6(r0, &(0x7f0000000940)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f00000009c0), 0x171}}], 0x400000000000172, 0x4000000)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000a00)={0x2, {{0xa, 0x4e21, 0x80, @mcast1, 0x7}}, {{0xa, 0x4e22, 0x3, @remote, 0xe}}}, 0x108)
executing program 6:
unshare(0x400)
r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x1, 0x18)
symlinkat(&(0x7f0000000000)='.\x00', r1, &(0x7f0000000140)='./file0\x00')
openat2(r1, &(0x7f00000008c0)='./file0/../file0\x00', &(0x7f0000000380)={0x100, 0x0, 0x11}, 0x18)
executing program 5:
mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000bc0)='./proc\x00', 0x1a8)
mount(0x0, &(0x7f0000000dc0)='./proc\x00', &(0x7f0000000e00)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000e40)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0)
write(r0, &(0x7f0000000e80)='7', 0x1)
futex(0x0, 0xd, 0x0, 0x0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x2, 0x0)
write(r1, &(0x7f0000000380)='2', 0x1)
write$sysctl(r0, &(0x7f0000000240)='7\x00', 0x2)
executing program 3:
r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000540)='.log\x00', 0x1c10c1, 0x9c37611dc13d0db7)
fchown(r0, 0x0, 0xee01)
r1 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r2=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0xee01, r2, 0x0)
fchown(r0, r2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
setreuid(0x0, 0xee00)
fchown(r0, 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0)
executing program 6:
epoll_create1(0x80000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="60000000020601080000000000000000000000010500010006000000050005000200000005000400000000000900020073797a3100000000140007800800064000000003080013400000040511000300686173683a6970"], 0x60}}, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080)
executing program 5:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000240)=ANY=[@ANYBLOB="1201100154e108101e041840b4ed010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000840)={0x40, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0)
bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1900"], 0x50)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002bbd7000fddbdf253700000008000300", @ANYRES32=r1, @ANYBLOB="080026006c0900000800a0006c09000008005700881300000800a10000100000080027"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x90)
executing program 3:
setns(0xc9, 0x40000000)
r0 = socket$inet6(0xa, 0x2, 0x0)
ioctl(r0, 0x8914, &(0x7f0000000000)="7770616e3000000000000000000000000100"/40)
ioctl(r0, 0x8914, &(0x7f0000000040)="6c6f7770616e300000000000000000000100"/40)
setsockopt(r0, 0x1, 0x19, &(0x7f0000000080)='lowpan0\x00', 0x8)
sendto$inet6(r0, &(0x7f0000000100)='lowpan_payload', 0xe, 0x0, &(0x7f0000000140)={0xa, 0x1234, 0x0, @empty}, 0x1c)

program crashed: kernel BUG in svc_destroy
bisect: bisecting 44 programs
bisect: split chunks (needed=false): <44>
bisect: split chunk #0 of len 44 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000040)='./file0\x00', 0x10000, &(0x7f0000000500)=ANY=[@ANYBLOB='nodots,showexec,dots,uid=', @ANYRESHEX=0xee00, @ANYBLOB=',check=normal,fmask=00000000000000000000002,sys_immutable,nodots,dots,nodots,nodots,nodots,fmask=00000000000000000177777,dots,quiet,nodots,nodots,check=relaxed,nodots,umask=00000000000000000076645,nodots,nodots,nfs=stale_rw,nodots,smackfsfloor=fmask,defcontext=unconfined_u,permit_directio,permit_directio,fscontext=staff_u,seclabel,euid>', @ANYBLOB="d323af6398d3b2b874d0760a23d467e0d7c5d5634e8c9dd180fb63defedeadbb6af1511ca99e46c631ff309fa72029dcdfd71bd42701db94658176f5a257c6555a5f53e4a1353909ef82738bc1dbe41abf0cabc79f71f86de9e642004bf455d93677ffb0377cd64bd841c62781cfdccc2d82b0f667f567e9689ce23dbfe5d99b53b81f0d8529449c6aa6da4d27ec95856e4dcff1b7d5202f8c2bb424425714694f46b3e5f20f4527ab00cf9097f9e8cdf49586734ba8c6d6986ec2357061559834bbd34aba8fb625343ee6168ecb4cd70cb1130d456c1af6966385b23f5818ed588294ca4eec3a202de54a93df5ed982fcd5cc626b39fe94cc39382532f603d712e78e440f9b19400d72d35034a30eff3a778ab8fdbbef8c31de21aa1428aa62b36e244ce07f49fef3272a0d819de933f6a9ed3ec053b0cdf3e77fd4178be01fc60c792d678b12b21546cd78876bbb78882c4296f7e0c3ee18c418a3a839ecaf6f52a42d66255790f1530fda7e2373f0108a06c5f0c83a6038ec2376a3043c34d5c4e23c45d10c4bec371f9b29012870cf4447bfb4d88425354677df9421caf2027ab2195d0604c4c8bdc0e1d8c551686cb44e487fa7ed9587120b5fc4c693d1b2f043026526e9aa5e98e31c206e69d1d871917a7d7e83653e5fd145f9d03e64f96b92ca83032072d8a7b53088d9a545a554cde2d383012f2b4bc74eaa3e630d944d58f0eb79a291493fa05dc69be36b144e5c5e4dc85463d4b6a4ada2f8b123b9d0f9120c4a7c3c8f1ab81af58836b0abfa63da805d27e1759d331fb5e8cdcdedf88a5446103ba1de1f3cddaebcb1583d0350c2967f63b00641adc704e9648f9c3790da6aa99838be8fce3c780f19c47444b6f3ba03f7d78b54310db92bdedde162a6af64368e6b60698bca97cde01c0bf198093d216571cd632cc1f2ef5682d02329e9f5eee174a7a9d239ba793c89fead42518b5574edab0bbe0cd62e9e88df6b6485c456f2c6d64e3a8c2ea093c15462e6abf7cc0f524740d6a302fa09bd89f77f16a4c11aed0c19acf8318e56adb2c95c499fa432ac9e8cccf7879d43f58c5839bff218aaac2ffadb5f47920b57a31ac0a499b2503b000b7410be1c341726e89916ee03ed88a2bacc3379efd0bed4cdde3e7f264112a014ccf7720d768f3240c4b1c7ba7e54c6c031127e8e6bc9a2b95bf58d45a507db17446fd4b293c33fcc475f5eafc07022da92e16b12e99e0626f08d965a35ca16df3ae3642271cc33999197720402eaffb661b2aba25fd486cea0660215048253df3da35577eca728851e009550d37ab89bdbb42cae68dfaf13ba20c9b9dcfa38c04c7a72a728abdca2daa877e3e66541bbe63c2f491faf13e631554efeb72bb2fac5de916bd56885369f2c7c0418fc8a66dcffa52a6bd902d1b733ee28e7503484f8411afc80582864e3b950a369fb6a5e6da5bdd906afa9daa1b967e0ae32bf3b5aa025da64be47e61c25ca825cafd3e428957e28ed0c89b762169472692ce874ffc504b853ca29669761429f991aba554555d117521be3ff239835c8eaaa9f8e0edb51e19cff17fba9466f30d6ee477b740a0ab71da8119c2a9527b2139426c78834da1c35a26eff38fcd81296c5e4cff92f6c9bd21dc6967312f499e5788833d5179b78704ccd1123e7773eb7e2a18fbdec5f06d02aaa7848b57ff801dabc6662df9e903d04173fed24c961f29b8a07fcc58a8b6b9df0939595ac6ebb72ba72c89f680e260011b995958cdd6a17943ec45cab7287e0591e40dc4de176e65fb727cfeffbad3cfc2bbaad22d09d8ef907beb2ba56867f066ab66e0fc4911407286b44d45c61e51b0e6065105aa68581f9c88940b99cb9212e9114f2dad5a4f0aa872a8f88e5770308cd06d7af5f7645946d31545a66069386b03706754c37a7874dccf2150cdf741dbf15b1e0751aa57bed556e5c383f1ad89f42f9c06bd6fabb8c33263fcf4391aab21999143bb54ff3fa0124abda0a704c3eb8231a2536dab0c76c3ce32b055d8b483bcc73eeab38b94653a5064213052806b02c1c4692f9e6ff929ef3ca0ff6f2d8a664406823b44e48cef2872e442b07cd847eff2c087ac4eb61e7fb589f36812a0899af59ba281c247342c7e3adcfb22098ab905fbef7d1e11ad49819b066781ed52d215c2e813b6b547d58db5c4fb74b8466ffcad54f4581315ae3016221e1122e52f629d2d0ed649a8df30b74cb4c64af64c785597f46d759f4152121f0c05b0e190ad75f0acca92c55fb62e749bb3bbb2fbfff94fa3dd6872dd5b38e6a764000da6f71b696152c0aa6f8c5b6b915d627f65f123455ff1c1330d31b802637fd6ac5556f3fba22510b5b144b58faf3c0478b024123294fb8feb97875047007ae8157bd34e08c1f0699838ffe0e0481247d03b61d8e39469597344106590faf6f76e1030b8d0e6ef10a49bc9cdbac2187ff5878d58feb3c8322ea282a9d446404a69715c410d874f358fcba191f35aa941fa17e27e2edfe33c0ecb314b0bef29a98d76273014eb5be4121a4c3c329ae2d9ece2efb1894e41b0ae4bb5cf29c3ddb14e5589a54dd4c0b0bbdc680f2f6b776bf9c0d68e444988dcda9b4f41d2e61e2f18ccfdf199844a383cb7bf67b3f309da8ef8ff13717329b992803375f1203685e8bcd4df89bb8f091deb354baf921e550c46c8478de0159006707dee0c41a7be6819ce4942e1d885ccccc8c3cafb84bf0459bfa5fe9424de093418c4f60c7fa98f7eb7886b897800d59207e088b213eb4f6a3f4db67daecf8ae906e732bc497d55d78d1c20a279b04f36d812031aef268364cda05499aa1184919ff2d865e3b2014942e2582e53ea8cdc5329ae9831c28c0bc4c9fc19fe12f3b27c077aa7ee56093902a5f9c3351d9c72fc61ad9c5a3c6b51df46ce84d485d34ebb4b9b5015492de3751b067dcb20e92130087fa69c15a1411611519c8adf2071565b77420bf0f6ef5c79000690ccf948c61c4cf4ffa8d81ec8dd7eb7a5e771be42b5cf35d06caca4cbd7272828619f1045f86165e87cf5d56a39d3e1de94b74e016759b0c4f3746ee3f5465439ce6f4737caa2d29cae0ae07f664da05767d72eeed7dfc0ac665fb1cfb042b936fa3dbf629d50a9c832a57f68073c48e1eaee20daee97ecb21192467598bf093e492f17346288902eb8d3570ad26c2263accd80feea8572f19b8bea68b95289aa5fd2d9471fa2046a6c62355b758743be4f82042caa3a2980473e5f59dd9bfc73864be3a36c4f8cefce917b01e64a532ca861bcd88d6c9483c85cac0ab03dbd9579119d0c760db3d00ad0ab3c63cedeaff9d36bcb045ecfe0f586fd92239890c20aaad20349b610840618e95d8b58f342af983a83d20b76ae7d1f0f4eedc8daabb801bdea8550a21fbd4f8c66452578e8d6ad54ef6fcc3f2726d28f7ab80e94929a611f5d20c2d11cbeb44aed284edf210469ae890ab0c0f1a57af8d218ea87d8942f8696a2dad99b3b6f4ec531237c72c98a613553bd972fa0ff7a5ee1c2cb51ffc6137c7a80a631be586a8df388c49944c9ad0540b4204e86d2a1a04db434a830798654b9d61a3205e53b80575d7767b393fb9e3d1c21bdf9db29cdc6feff5483d189f4b55c4e04cfa17dad004b3abc0e7f52cad62898fa45a61e873298b4136bef49deeba85bcb172d1a4c6f49d7df1a0aa18fd4dbe165e144139d949222c93cc6369579ac80827d015bc78e3d96a3c5bd26d98df194769d3f1b8f474e9e10df1284ac316e55b309cefe561d629d507f06ccf985e565fb3da0b4a76cc2e099c1f7dd5d6f065854c877f890cc449973c31bc76ac462dec2039e10c3fd3eefac2a5d2fcac60fa069d9c443d650c0807f5a52624c65d8bb4647d02b15fc694bde11e9c06996b99614157669b422d39150094dd78ad62b45a9b62d4c5fd447b293088bf177b81340de59674217edfe1bac8f6f586e248a828081b7a4ebd3108471a572f688fee6e45463794320fa1fe0ea42b4ac788ca20e5fa71617065c198983eb25b3b543664751ddacb0f0f354fc60d0fcde34546ea9e7570195d3aef8f437b1e341c121e9465dd816af8914e840624b30f2d0cf932cc7c0cc5b29537ab12cffb95093290ae16308184101c9aa6b36828beb1208d5f21e0fb5d9ae83db0806720c1332f739b560cbe8ed28764b62ea7d3db2e1bc2ef75ddbc60a2c396d16a42ea52f0120e4e6d4daecebac1ce0718f3454d101c64cae2d88d913219f2b7c4871083cf79d17e86885c436704b6542228b66c92035d5d0ccf6a4f111c2c7663bc1189af84da738046df10a64aea378c6fca7050c287914f64952495af275d6afcc05f5fb390e25bdefc08ce60f4f935dfc16a85a4696068543edc824e3b561d0a06621170932d3ccb801a41a9f10b2ce4d882af46973b4de248f4cfeb5380d3cda6741980a7e90bfcc9291fd211650a7cbad818edd43a74028f1d47688044cd443d535a82d1da7fc793e696b648e36bfac427436cbc205270926af839a8dbdd725cc5ad6ca5491194b2a0238f85baa1211239bf81ee89f96b4df7671ba9914afb0a3c33c8e3ca1745f278d8859d010dc61457eacf2b56b8413f67c32eaaaf14091b8f112602bffb7ec872f20943c8beb4f3e01c2dcf30326194a6ba3332c0f141a68c428368e2aa944ef35cd665c3b394788836f6b2c694b928ec507a38e4f93142c71db1bd8e2eeba8d389a2b82e520f23e526bd3f4446d9e1ae6794f5b2da537bc803f03ecaa2c0bbd91fb0885156b1e77e0f7324eec99ea0461786241b3bb4a4f0fd317ba521e4576973afcc0e48c9c32c576229cff2267717e651db598061ac2368065b1a80ab97c22de8668ee8f98f05db24a2b7d4f029034c574ee0211d55007c7ad1313d2c3ca1792e896ee9ec40400bf35643bf81ae10da131ec935c0562e4cdd1554677bd54588b5a0b0b5fd0a37482cfab046230aa50e1030afd1085b1e8a7b7d428639c64f845dd45e173dc8ccaf9e86249ff7dc625a30b9c42fdf75271090c9263cf0ef662e1fea6067c41dd4a70573debf66f4f1b7f3a8cf069de7699a454420144388e2ae1f8150d83f7f52e3817c9f66bc7cdbed7c597db66393f35ff73cc6cda31d49b21ee817da91c00ecb614e4b9a0c10ccf54c26ec0e683b9703eae7a534a8af479002bdb18a0625f4b284c2cb09b608ec189a0c370a092922e0e74484aeef2f4578db4a103841cb31c7d167c46fbe881911693e8399ee5ba0756f52df83550a6aad3d637ac4fa9f054714b61e1485210b8cccae5c3c8f6059c0b2dc614088aacde3ec782845f0996e1c21188a57f6991cad09f96ef5f35065b919077977da0aa15b56f49ca996309f8a469bd0b318a3be892d39b1d17403753955e897b95297fff2e0ea5be5411935a8ff1ac29189e75682d7b0345b7100509c8ad08a23b2dfcd7654f4b5951af4d238c69bfd6154ab4b1058cf9659f3ce9079e640771e2e2f6fe430451831aa43b0202f276e276149d87ce5ded959801d03913443f8dfe8006ca35a10d98186f1718db5b17c5e5c9500c1c9e6b7e2cccd43a57012f1b6b28a928fd1c95f462eef4fe01f2b8b5d909d97d96e8d2564b309cf22059c0a852a97a8ca99ba9535816d6b149a5d1b7e239c21f1d1589e2f68ea9d36c3bad7026bee94bb59daf725ffbcb7bbe982cf88b89f911ebe45f98af2130175783c9836eeb8c6051398e16784f82c8a5cd1db6aa1de56f9aa3715b9ff96ad195b78d9fcefba1cec129c239d11b40e688f99", @ANYRES64=0x0], 0x1, 0x1f5, &(0x7f0000000300)="$eJzs3cFqE1EUANCbmCYTcdGdIAgjLnRV1C+oSAUxIFSy0J2gK7NqN6mb9jP8Bf/LD5CuspEncSadmKYxBDKj7Tmb3pn7Xt+7M2SSTW5SFL7f/RpZ1or2fuzHpBW70Y6ZswAArpNJSvEjFZreCwBQjzXe/3/WvCUAYMvevnv/+vlgcHCY51nE+dl4OB4Wf4v8y1eDgyf5b7vVrPPxeHjrIv80X/zsMM3vxO0y/6yYn1+kuxEx7Mbjh0V+mnvxZpD/Ob8XH7dcOwAAAAAAAAAAAAAAAAAAAAAANOV+5DNL+/vs7S3m+2W+OJrrD7TQv6cT9zrlYdUeKJ3WURQAAAAAAAAAAAAAAAAAAAD8Z45Pvnz+MBp9OqqCXkTMn+ksGXN10Cr/8VqDmw/asdn0flnmBou2yku03QL7y2/uOkF0/pW7s2mQ17BWf+XlTWkaLH8VzNpiXDm9GxGrV390uOnmJyml0bcHR8cnkVYOrp4RvVqfSAAAAAAAAAAAAAAAAAAAcHPNfev7kqyJDQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAA6rf/58Gl8+sDE4j4k78dfBsrZ3IGq0VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA6+tXAAAA//85ziI4")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
fcntl$notify(r0, 0x402, 0x30)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xae)
write(0xffffffffffffffff, 0x0, 0x0)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(r1, 0x40047211, &(0x7f0000000100))
executing program 5:
io_setup(0x2278, &(0x7f0000000180)=<r0=>0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000040)={0x77359400}, 0x10)
io_submit(r0, 0x1, &(0x7f0000000140)=[&(0x7f00000001c0)={0x0, 0x4, 0x0, 0x0, 0x0, r1, &(0x7f0000000440)='5', 0x1, 0x0, 0x0, 0x2}])
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]})
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x58, 0x2c, 0xd3f, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0x0, 0x9}, {0x10}}, [@filter_kind_options=@f_flower={{0x24}, {0x28, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x6006}, @TCA_FLOWER_KEY_IPV4_DST={0x8, 0xc, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_FLOWER_KEY_ENC_IPV6_SRC={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x4080)
executing program 3:
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_mount_image$exfat(&(0x7f0000000040), &(0x7f0000000080)='./file2\x00', 0x80, &(0x7f00000000c0)=ANY=[], 0x7d, 0x1508, &(0x7f0000000400)="$eJzs3Au0TlXXOPA511qb4+TyJLnvuebmSS6LJAklySVJkpDcE5IkSZLEIbckJCHXk+Qeck8nHff7Jfekk1eSJCEhyfqP0+Xv6633873v1/f3/r8zf2OscdY8e8211zpzPOfZe4/xPF93HVa9UY0q9ZkZ/hX6tw7+8iMJABIAYCAA5ACAAADK5iybM/14Fo1J/9JJxP+QBjOu9ArElST1z9ik/hmb1D9jk/pnbFL/jE3qn7FJ/TM2qb8QGdqsfFdLy7hNnv//f079d5Ll/T9DwH90QOr/v43+p0ZL/TM2qX/GJvXP2KT+GVlwpRcgrjB5/WdsUn8hMrS//JnyhnNX+pm2tH+iCSGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ/w+c85cYAPit/4eBCVdkeUIIIYQQQgghhPgL+Hev9AqEEEIIIYQQQgjxPw9BgQYDAWSCzJAAWSARroKskA2yQw6IwdWQE66BXHAt5IY8kBfyQX4oAAUhBAILDBEUgsIQh+ugCFwPRaEYFIcS4KAklIIboDTcCGXgJigLN0M5uAXKQ4Wfz5nudqgMd0AVuBOqQjWoDjXgLqgJd0MtuAdqw71QB+6DunA/1IMHoD40gIbwIDSCh6AxNIGm0AyaQwtoeZn85Bx/lv889IAXoCf0giToDX3gRegL/aA/DICB8BIMgpdhMLwCQ2AoDINXYTi8BiPgdRgJo2A0vAFjYCyMg/EwASZCMrwJk+AtmAxvP5QNpsI0mA4zYCbMgndgNsyBufAuzIP5sACSsyyCxbAE3oOl8D6kwAewDD6EVFgOK2AlrILVsAbWwjpYDxtgI2yCzbAFtsI2+Ai2ww7YCbtgN+yBvfAx7INPYD98Cmn42T+Zf/b3+dANAQEVKjRoMBNmwgRMwERMxKyYFbNjdoxhDHNiTsyFuTA35sa8mBeTMD8WxIJISMjIWAgLYRzjWASLYFEsisWxODp0WApLYWm8EctgGSyLZbEclsPyWAEr4K14K1bCSlgZK2MVrIJVsSpWx+p4F96Fd2MtrIW1sTbWwTpYF+tiPayH9bE+NsSG2AgbYWNsjE2xKTbH5tgSW2IrbIWtsTW2xbbYDtthe2yPHbADdsSO2Ak7YWfsjF2wC3bFrtgNn8Pn8Hl8Hl/AF7AXVlW9sQ/2wb7YF/vjAByAL+EgfBlfxldwCA7FYfgqvoqv4Qg8gyNxFI7G0VhJjcVxOB5ZTcRkTMbMMAkn42ScglNxKk7HGTgTZ+EsnI1zcA6+i/NwPs7HhbgQF+MSXIJL8X1MwRRchmcxFZfjClyJq3A1rsK1uA7X4gbciBtwM27GrbgVP8KPcAfuwF24C/fgHvwYP8ZP8BMcgmmYhgfwAB7Eg3gID+FhPIxH8AgexaN4DI/hcTyOJ/AknsKTeBpP4xk8i+cA4Dyexwt4AS/ixfQXv0pnlFGZVCaVoBJUokpUWVVWlV1lVzEVUzlVTpVL5VK5VW6VV+VV+VV+VVAVVKRIsYpUIVVIxVVcFVFFVFFVVBVXxZVTTpVSpVRpVVqVUWVUWXWzKqduUeVVBdXG3apuVZVUW1dZ3aGqqCqqqqqmqqsaqoaqqWqqWqqWqq1qqzqqjqqr7lf1VG/sjw1UemUaqaHYWA3DpqqZaq5aqNfwYdVKjcDWqo1qqx5Vo3AktletXAf1hOqoxmEn9ZQaj0+rLmoidlXPqm7qOdVdPa96qNaup+qlpmBv1UdNx76qn+qvBqjZWE2lV6y6ekU9n3moGqZeVYvxNTVCva5GqlFqtHpDjVFj1Tg1Xk1QE1WyelNNUm+pyeptNUVNVdPUdDVDzVSz1Dtqtpqj5qp31Tw1Xy1QC9UitVgtUe+ppUqrFPWBWqY+VKlquVqhVqpVarVao9aqdWq92qA2qk1qs9qitqpt6iO1Xe1QO9UutVvtUXvVx2qf+kTtV5+qNPWZOqD+pg6qz9Uh9YU6rL5UR9RX6qj6Wh1T36jj6lt1Qp1Up9R36rT6Xp1RZ9U59YM6r35UF9RP6qLyCjRqpbU2OtCZdGadoLPoRH2Vzqqz6ew6h47pq3VOfY3Opa/VuXUendfk0/l1AV1Qh5q01awjXUgX1nF9nS6ir9dFdTFdXJfQTpfUpfQNurS+UZfRN+my+mZdTt+iy+sKuqIHfZuupG/XlfUduoq+U1fV1XR1XUPfpWvqu3UtfY+ure/VdfR9uq6+X9fTD+j6uoFuqB/UjfRDurFuopvqZrq5bqFb6od1K/2Ibq3b6Lb6Ud1OP6bb68d1B/2E7qif1J30U7qzflp30c/orvpZ3U0/p7vrn/RF7XVP3Usn6d66j35R99X9dH89QA/UL+lB+mU9WL+ih+iheph+VQ/Xr+kR+nU9Uo/So/Ubeoweq8fp8XqCnqiT9Zt6kn5LT9Zv6yl6qp6mp+sZeqbu/+tMc/8L+W/9Sf7gn8++VW/TH+nteofeqXfp3XqP3qv36n16n96v9+s0naYP6AP6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+iT+gf9nT6tv9dn9Fl9Vv+gz+vz+sKvfwMwaJTRxpjAZDKZTYLJYhLNVSaryWaymxwmZq42Oc01Jpe51uQ2eUxek8/kNwVMQRMaMtawiUwhU9jEzXWmiLneFDXFTHFTwjhT0pQyN/y38y+3vpampWllWpnWprVpa9qadqadaW/amw6mg+loOppOppPpbDqbLqaL6Wq6mm6mm+luupsepofpaXqaJJNk+pgXTV/Tz/Q3A8xA85IZZAaZwWawGWKGmGFmmBluhpsRZoQZaUaa0Wa0GWPGmHFmnJlgJphkn8NMMpPMZDPZTDFTzLSBOcwMM8PMMrPMbDPbzDVzzTwzzywwC8wis8gsMUvMUrPUpJgUs8wsM6lmuVluVpqVZrVZbdaatWa9WW82mo1ms9lsUs02s81sN9vNTrPT7Da7zV6z1+wz+8x+s9+kmTRzwBwwB81Bc8gcMofNYXPEHDFHzVFzzBwzx81xc8KcMKfMKXPanDZnzBlzzpwz5815c8FcMBfNxfTLvkAFKjCBCTIFmYKEICFIDBKDrEHWIHuQPYgFsSBnkDPIFVwb5A7yBHmDfEH+oEBQMAgDCmzAQRQUCgoH8eC6oEhwfVA0KBYUD0oELigZlApuCEoHNwZlgpuCssHNQbnglqB8UCGoGNwa3BZUCm4PKgd3BFWCO4OqQbWgelAjuCuoGdwd1AruCWoH9wZ1gvuCusH9Qb3ggaB+0CBoGDwYNAoeChoHTYKmQbOgedAiaPmXzu/9mTyPuJ5hrzAp7B32CV8M+4b9wv7hgHBg+FI4KHw5HBy+Eg4Jh4bDwlfD4eFr4Yjw9XBkOCocHb4RjgnHhuPC8eGEcGKYHL4ZTgrfCieHb4dTwqnhtGB6OCOcGc4K3wlnh3PCueG74bxwfrggXBguCheH+MslMaSEH4TLwg/D1HB5uCJcGa4KV4drwrXhunB9uCHcGG4KN5cd9MvQcHu4I9wZ7gp3h3vCveHH4b7wk3B/+GmYFn4WHgj/Fh4MPw8PhV+Eh8MvwyPhV+HR8OvwWPhNeDz8NjwRngxPhd+Fp8PvwzPh2fBc+EN4PvwxvBD+FF4MffrFffrbOxkylIkyUQIlUCIlUlbKStkpO8UoRjkpJ+WiXJSbclNeykv5KT8VpIKUjompEBWiOMWpCBWholSUilNxcuSoFJWi0lSaylAZKktlqRyVo/JUnipSRbqNbqPb6Xa6g+6gO+lOqkbVqAbVoJpUk2pRLapNtakO1aG6VJfqUT2qT/WpITWkRtSIGlNjakpNqTk1p5bUklpRK2pNrakttaV21I7aU3vqQB2oI3WkTtSJOlNn6kJdqCt1pW7UjbpTd+pBPagn9aQkSqI+1If6Ul/qT/1pIA2kQTSIBtNgGkJDaBgNo+E0nEbQCBpJo2g0vUFjaCyNo/E0gSZSMiXTJJpEk2kyTaEpNI2m0QyaQbNoFs2m2TSX5tI8mkcLaAEtokW0hJbQUlpKKZRCy2gZpVIqraAVtIpW0RpaQ+toHW2gDbSJNtEW2kLbaBttp+20k3bSbtpNe2kv7aN9tJ/2Uxql0QE6QAfpIB2iQ3SYDtMROkJH6Sgdo2N0nI7TCTpBp+gUnabTdIbO0Dk6R+fpR7pAP9FF8pRgs9hEe5XNarPZ7DaH/fs4r81n89sCtqANbW6b53cxWWuL2mK2uC1hnS1pS9kb/hCXtxVsRXurvc1Wsrfbyra8zQL/Ma5p77a17D22tr3X1rB3/S6uY++zde1Dtp5tYuvbZrahbWEb2YdsY9vENrXNbHPbwrazj9n29nHbwT5hO9on/xAvte/bdXa93WA32n32E3vO/mCP2q/tefuj7Wl72YH2JTvIvmwH21fsEDv09zGAHW3fsGPsWDvOjrcT7MQ/xNPsdDvDzrSz7Dt2tp3zh3iJfc/Osyl2gV1oF9nFP8fpa0qxH9hl9kObapfbFXalXWVX2zV27f9d60q72W6xW+1e+7HdbnfYnXaX3W33/Byn72O//dSm2c/sEfuVPWg/t4fsMXvYfvlznL6/Y/Ybe9x+a0/Yk/aU/c6ett/bM/bsz/tP3/t39id70XoLjKxYs+GAM3FmTuAsnMhXcVbOxtk5B8f4as7J13AuvpZzcx7Oy/k4PxfgghwysWXmiAtxYY7zdVyEr+eiXIyLcwl2XJJL8Q1cmm/kMnwTl+WbuRzfwuW5AlfkW/k2rsS3c2W+g6vwnVyVq3F1rsF3cU2+m2vxPVyb7+U6fB/X5fu5Hj/A9bkBN+QHuRE/xI25CTflZtycW3BLfphb8SPcmttwW36U2/Fj3J4f5w78BHfkJ7kTP8Wd+Wnuws9wV36Wu/Fz3J2f5x78AvfkXpzEvbkPv8h9uR/35wE8kF/iQfwyD+ZXeAgP5WH8Kg/n13gEv84jeRSP5jd4DI/lcTyeJ/BETuY3eRK/xZP5bZ7CU3kaT+cZPJNn8Ts8m+fwXH6X5/F8XsALeREv5iX8Hi/l9zmFP+Bl/CGn8nJewSt5Fa/mNbyW1/F63sAbeRNv5i28lbfxR7ydd/BO3sW7eQ/v5Y95H3/C+/lTTuPP+AD/jQ/y53yIv+DD/CUf4a/4KH/Nx/gbPs7f8gk+yaf4Oz7N3/MZPsvn+Ac+zz/yBf6JL7JniDBSkY5MFESZosxRQpQlSoyuirJG2aLsUY4oFl0d5YyuiXJF10a5ozxR3ihflD8qEBWMwogiG3EURYWiwlE8ui4qEl0fFY2KRcWjEpGLSkalohui0tGNUZnopqhsdHNULrolKh9ViCpGt0a3RZWi26PK0R1RlejOqGpULaoe1YjuimpGd0e1onui2tG9UZnovqhudH9UL3ogqh81iBpGD0aNooeixlGTqGnULGoetYhaRg9HraJHotZRm6ht9GjULnosah89HnWInog6Rk9eOl4s+OXd9O+OJ0W9I/3rE7J79KL44viS+HvxpfH34ynxD+LL4h/GU+PL4yviK+Or4qvja+Jr4+vi6+Mb4hvjm+Kb41viW+Pe18gMDtNvhMG4wGVymV2Cy+IS3VUuq8vmsrscLuaudjndNS6Xu9bldnlcXpfP5XcFXEEXOnLWsYtcIVfYxd11roi73hV1xVxxV8I5V9KVci1cS9fStXKPuNaujWvrHnWPusfcY+7x3z6r4zq5p1xn97Tr4p5xz7hnXTf3nOvunnc93Auup+vlklyS6+P6uL6ur+vv+ruBbqAb5Aa5wW6wG+KGuGFumBvuhrsRboQb6Ua60W60G+PGuHFunJvgJrhkl+wmuUluspvsprgpbpqb5ma4GW6Wm+Vmu9lurpvr5rl5boFb4Ba5RW6JW+KWuqUuxaW4ZW6ZS3WpboVb4Va5VW6NW+PWuXVug9vgNrlNbovb4ra5bW672+52up1ut9vt9rq9bp/b5/a7/S7NpbkD7oA76A66Q+4Ld9h96Y64r9xR97U75r5xx9237oQ76U45r0+7790Zd9adcz+48+5Hd8H95C4675Jjb8Ymxd6KTY69HZsSmxqbFpsemxGbGZsVeyc2OzYnNjf2bmxebH5sQWxhbFFscWxJ7L3Y0tj7sZTYB7FlsQ9jqbHlsRWxlbFVsdUx7wtsj3whX9jH/XW+iL/eF/XFfHFfwjtf0pfyN/jS/kZfxt/ky/qbfTl/iy/vK/iKvolv6pv55r6Fb+kf9q38I761b+Pb+kd9O/+Yb+8f9x38E76jf9J38k/5zv5p38U/47v6Z+f/WmXfw7/ge/pePsn39n38i76v7+f7+wF+oH/JD/Iv+8H+FT/ED/XD/Kt+uH/Nj/Cv+5F+lB/t3/Bj/Fg/zo/3E/xEn+zf9JP8W36yf9tP8VP9ND/dz/Az/Sz/jp/t5/i5/l0/z8/3C/xCv8gv9kv8e36pf9+n+A/8Mv+hT/XL/Qq/0q/yq/0av9av8+v9Br/Rb/Kb/Ra/1W/zH/ntfoff6Xf53X6P3+s/9vv8J36//9Sn+c/8Af83f9B/7g/5L/xh/6U/4r/yR/3X/pj/xh/33/oT/qQ/5b/zp/33/ow/68/5H/x5/6O/4H/yF//sM2tCCCGEEOIP9GWO9/6T36lfW7o+AJBtR77Dfz/npty/9PupfR1jAPBEr64NfmsNGiQlJf06NlVDUHghAMQu5f/8/QO/xsuhLTwGHaANlP7T9fVTFX++7vvP5o/fDJAIkOW3nPTbo0T4+/lv/AfzN3mPLzf/QoCihS/lpJ/ot/jS/GX+wfx72l1m/iyfJwO0/g85WeFSfGn+UvAIPAkdfjdSCCGEEEIIIYT4RT91vtvl7m/T78/zm0s5meFSfLn788uo/FfsQQghhBBCCCGEEP+5p5/r/vjDHTq06fy/uZP532MZ/wYdBIB/g2VI59+/c6X/MwkhhBBCCCH+apcu+q/0SoQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiIzrX/+GMPVfHnyl9yiEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEJcaf8nAAD//8jaVSM=")
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0)
r0 = open(&(0x7f0000001980)='./file1\x00', 0x14e142, 0x90)
pwritev2(r0, &(0x7f00000019c0)=[{&(0x7f0000001a00)="85", 0x140000}], 0xf, 0x7000, 0x0, 0x3)
executing program 4:
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r3, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/video4linux/video0/dev_debug\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='3', 0x1)
r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000240)={0x0, 0x1, 0xffffffff, r0, 0x0, &(0x7f0000000140)={0x9a091c, 0x7, '\x00', @p_u32=0x0}})
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x48241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000240)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
write$tun(r0, &(0x7f0000000840)={@val={0x0, 0x6003}, @void, @eth={@local, @empty, @val={@void, {0x8100, 0x0, 0x1, 0x3}}, {@ipv6={0x86dd, @generic={0x1, 0x6, '\x00\a\x00', 0x18, 0x2b, 0x0, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {[@routing={0x4, 0x0, 0x0, 0x5}, @dstopts={0x6}, @hopopts]}}}}}}, 0x56)
executing program 6:
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c, &(0x7f0000000140)=[{&(0x7f00000001c0)='`', 0x1}], 0x1, &(0x7f0000000240)=ANY=[@ANYBLOB="480000000000000029000000370000002b0500000000000007280000000308480400030000000000000008000000000000000104000000000000080000000000000004010300000014000000000000002900000043000000080000000000000050"], 0xb0}}], 0x1, 0x4000801)
mkdirat(0xffffffffffffff9c, &(0x7f00000013c0)='./proc_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000001400)='./proc_mnt\x00', &(0x7f0000001440)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000001480)='./proc_mnt/net/sctp/assocs\x00', 0x0, 0x0)
read$rfkill(r1, &(0x7f00000014c0), 0xfffffcfe)
executing program 5:
r0 = socket(0x10, 0x803, 0x0)
r1 = socket(0xa, 0x3, 0x87)
r2 = socket(0xa, 0x3, 0x87)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000840)={'veth1_macvtap\x00', <r3=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000880)={@local, 0x40, r3})
sendmsg$nl_route(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbfd, {0xa, 0x3f, 0x0, 0xc8, r3}, [@IFA_FLAGS={0x8, 0x8, 0x582}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c040}, 0x8000)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x300f401, 0x0, 0x2, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
chdir(&(0x7f00000003c0)='./bus\x00')
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='io.stat\x00', 0x275a, 0x0)
write$P9_RLERRORu(r0, 0x0, 0x14)
executing program 3:
syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000000)='./file0\x00', 0x180c8, &(0x7f00000006c0)=ANY=[@ANYBLOB="6e66732c646f74732c636865636b3d7374726963742c646f74732c6572726f72733d72656d6f756e742d726f2c00f8403bb14281bbfb9b8213bd6284536d64789a24dd73b98b3e33cb47fed8a7364664b62e9e891aa832722dfc28bfa4489b3a127a503e72326b737d0f67c97be6f37ef46154dec39ef8718946ffc8cd4d735a0b101c1722477bbe2f923577ea51f7116f17c3ddf5c497fba2d0bb3272d123b31e9461d4e2d65a42e1174fa269de92e463fc1cde2367bdb50cc5b2b462e1d45fc3265f1a88561ab6afb1b73a3b340b5c73055fc6e601843a59f3cdeb36991cfa985453287d4c9d2d6e21adddc57a607369c682e821b20dc0efd51d12f386f3f8e53c05e696e50c7c3f79b1b0bd7e5cfaf3f63d8949c8dd2fd94aa0f259a4cb9412c30c45f9d4d63d267d2a43f03a47fa56b3000000f9ffffffffffffff000000"], 0x9, 0x250, &(0x7f0000000300)="$eJzs3cFqE0EYB/DPJG1jL/YsHha8eArqyWuQCmJAiOSgJwPVSyvC9rJ62sfwGXwkH6On3lbaXZq2xl50M+3u7wdhPvgTZgZCJodvsh8ffTk8+Hr8ufr1I8bjLEYRZVVF7MUghlG714yD83o7LisDALhr5vPlNPUaaFeeT5dbEbHzR7L4mWRBAAAAAAAAAAAA/LN1/f9xqv8fALpM/38XDG9M83y63G1+v12l/x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABI57SqHlQ3vFKvDwD4/5z/ANA/zn8A6B/nPwD0z7v3H95MZ7P9eZaNI07KYlEs6rHOX72e7T/Nzu2t3nVSFIvhRf6szrOr+VbsNvnztfl2PHlc52fZy7eza/lOHLS/fQAAAAAAAAAAAAAAAAAAALgVJtmFtff7J5O/5XV16f8Brt3fH8XD0ca2AQAAAAAAAAAAAAAAAAAAAHfa8bfvh8ujo0+5ojNFvGh9ikHz8bktWz4rIjY+6f1IMOmGisRfTAAAAAAAAAAAAAAAAAAA0EOrS7+pVwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6aye/99eERFlVUu9XQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDDfgcAAP//wzuVuw==")
munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000)
sendto$inet6(0xffffffffffffffff, &(0x7f00000001c0)="a6e2976b5c", 0x5, 0x840, 0x0, 0x0)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2000c850, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_mount_image$fuse(0x0, &(0x7f00000001c0)='./file1\x00', 0x3000408, 0x0, 0x1, 0x0, 0x0)
executing program 6:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, 0x0}], 0x1, 0x41, &(0x7f0000000000)=[@cr4={0x1, 0x408e2}], 0x1)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, &(0x7f0000000080)="400f23280f019c990e000000b91a0200000f32c344240000600000c744240200800000c7442406000000000f011c246566262e440f23b126673e660f382943b0c4c3914984fb499e00007fc744240000000000c744240278581667c74424060000000004011c2467440fc7580066b804008ee8", 0x73}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
pipe2(&(0x7f0000000180)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x84800)
write$P9_RGETLOCK(r2, &(0x7f0000000040)=ANY=[], 0xffffff6a)
pipe2(&(0x7f0000000200)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
tee(r1, r3, 0xfffffffffffffc01, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x5, 0x4, 0x1, 0x8}, 0x50)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000040)={r2}, 0xc)
executing program 4:
socket$inet_tcp(0x2, 0x1, 0x0)
unshare(0x22020600)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={0x2adc0, 0x1c1, 0x6}, 0x18)
r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0)
write$binfmt_register(r0, &(0x7f0000000100)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x46d0, 0x3a, '\xe2\xbf\xd9\xafk\xd3~a3\xd0\x94', 0x3a, 'u', 0x3a, './file0', 0x3a, [0x4f, 0x4f, 0x4f, 0x50, 0x46]}, 0x38)
executing program 6:
prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7)
r0 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x13)
tkill(r0, 0x12)
waitid(0x1, r0, 0x0, 0xb, &(0x7f0000000240))
executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newsa={0x138, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x0, 0x0, 0xd, 0xa, 0x80, 0x80}, {@in6=@loopback, 0x4d2, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@dev={0xac, 0x14, 0x14, 0x19}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x794, 0x4e23, 0x7, 0x0, 0x0, 0x0, 0x3a}, {@in=@broadcast, 0x4d6, 0x6c}, @in6=@dev={0xfe, 0x80, '\x00', 0x36}, {0x3, 0x192, 0x6, 0x2, 0x3, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x3, 0xfffffff9, 0x40}, 0x70bd2a, 0x34fc, 0x2, 0x1, 0xfe, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0)
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
sendto$inet6(r0, &(0x7f0000000380)="4e813cbfba", 0x5, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='highspeed', 0x9)
shutdown(r0, 0x1)
executing program 3:
socket$netlink(0x10, 0x3, 0x0)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='for', 0x3)
executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000780)={0x2b, 0x2b, '\x00', [@padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x8, {0x3, 0x0, 0x79, 0x7}}, @calipso={0x7, 0x48, {0x0, 0x10, 0xc0, 0x1, [0x73, 0x934, 0xfff, 0x5, 0x4, 0x3, 0x1, 0x4]}}, @generic={0xa1, 0x5b, "59cb7288795557ea9b476f3cdb080e63b0687cfaadbe599ac45d6d9071575e05df28a3621a9e375e5d18423e41aafd04bd5c9a63b238058141a021516617cb0bdd08f1e49a8a23412561a9421553c62b7720908b23437f9ca7c336"}, @pad1, @calipso={0x7, 0x10, {0x0, 0x2, 0x51, 0xf, [0xfe]}}, @generic={0x6, 0x87, "9a01485ecac729407a0390fc142e75498f5b3f81a83039a4a1bfaef9e1731bc1400d7af38b66731fc290724a29b93a088fca4ca0fa6e7ca5d52789b8fc1b4288ecac3bdc903f17cc4fc2c7908070b70034f6f8ddfaf7a78eb482c76d46b874faef2ecc3119da102289d7777570b235deb851b9201c076c91eb874b616201d00f0681dfb294ec0e"}]}, 0x160)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000900)={0x200000000000001}, 0x8)
connect$inet6(r0, &(0x7f0000000940)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f00000009c0), 0x171}}], 0x400000000000172, 0x4000000)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000a00)={0x2, {{0xa, 0x4e21, 0x80, @mcast1, 0x7}}, {{0xa, 0x4e22, 0x3, @remote, 0xe}}}, 0x108)
executing program 6:
unshare(0x400)
r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x1, 0x18)
symlinkat(&(0x7f0000000000)='.\x00', r1, &(0x7f0000000140)='./file0\x00')
openat2(r1, &(0x7f00000008c0)='./file0/../file0\x00', &(0x7f0000000380)={0x100, 0x0, 0x11}, 0x18)
executing program 5:
mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000bc0)='./proc\x00', 0x1a8)
mount(0x0, &(0x7f0000000dc0)='./proc\x00', &(0x7f0000000e00)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000e40)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0)
write(r0, &(0x7f0000000e80)='7', 0x1)
futex(0x0, 0xd, 0x0, 0x0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x2, 0x0)
write(r1, &(0x7f0000000380)='2', 0x1)
write$sysctl(r0, &(0x7f0000000240)='7\x00', 0x2)
executing program 3:
r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000540)='.log\x00', 0x1c10c1, 0x9c37611dc13d0db7)
fchown(r0, 0x0, 0xee01)
r1 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r2=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0xee01, r2, 0x0)
fchown(r0, r2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
setreuid(0x0, 0xee00)
fchown(r0, 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0)
executing program 6:
epoll_create1(0x80000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="60000000020601080000000000000000000000010500010006000000050005000200000005000400000000000900020073797a3100000000140007800800064000000003080013400000040511000300686173683a6970"], 0x60}}, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080)
executing program 5:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000240)=ANY=[@ANYBLOB="1201100154e108101e041840b4ed010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000840)={0x40, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0)
bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1900"], 0x50)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002bbd7000fddbdf253700000008000300", @ANYRES32=r1, @ANYBLOB="080026006c0900000800a0006c09000008005700881300000800a10000100000080027"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x90)
executing program 3:
setns(0xc9, 0x40000000)
r0 = socket$inet6(0xa, 0x2, 0x0)
ioctl(r0, 0x8914, &(0x7f0000000000)="7770616e3000000000000000000000000100"/40)
ioctl(r0, 0x8914, &(0x7f0000000040)="6c6f7770616e300000000000000000000100"/40)
setsockopt(r0, 0x1, 0x19, &(0x7f0000000080)='lowpan0\x00', 0x8)
sendto$inet6(r0, &(0x7f0000000100)='lowpan_payload', 0xe, 0x0, &(0x7f0000000140)={0xa, 0x1234, 0x0, @empty}, 0x1c)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000a80)={0x1, &(0x7f0000000ac0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]})
close_range(r0, 0xffffffffffffffff, 0x0)
openat$ptp0(0xffffffffffffff9c, &(0x7f0000000b00), 0x0, 0x0)
clock_gettime(0xfffffffffffffffb, 0x0)
executing program 0:
r0 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r0, &(0x7f0000000200)={0xa, 0xf3, 0x14, @mcast1, 0x9}, 0x1c)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000280)=0x655e, 0x4)
r1 = dup2(r0, r0)
write$tun(r1, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x46)
recvmmsg(r1, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0}, 0x3ff}], 0x1, 0x2000, 0x0)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x4, 0x6, 0xbaa}, 0x48)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0), 0xa7c, r0}, 0x38)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.dequeue\x00', 0x26e1, 0x0)
close(r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240))
ioctl$SIOCSIFHWADDR(r1, 0x8b19, &(0x7f0000000280)={'wlan0\x00', @random="7cf1e97c9e4f"})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0))
ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8)
ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800000000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x0, 0x0)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800004000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x4, 0xfffffffd)
executing program 1:
setns(0xc9, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2)
ftruncate(r1, 0xffff)
fcntl$addseals(r1, 0x409, 0x3)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r1, 0x1, 0x0, 0x2000})
ioctl$DMA_BUF_SET_NAME_A(r2, 0x40046201, &(0x7f0000000140)='log\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/video4linux/video0/dev_debug\x00', 0x1, 0x0)
write(r0, &(0x7f0000000640)='3', 0x1)
r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0)
ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f00000006c0)={0x9d0000, 0x5, 0x8, r0, 0x0, &(0x7f0000000700)={0x98090d, 0x9, '\x00', @value64=0x1000000005a9}})
executing program 1:
mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b)
mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0)
mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x10454ca, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 32:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 33:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42040, 0x1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x12, r1, 0xc76ed000)
write(r0, &(0x7f0000000040)='an0m', 0x4)
executing program 6:
prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7)
r0 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x13)
tkill(r0, 0x12)
waitid(0x1, r0, 0x0, 0xb, &(0x7f0000000240))
executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newsa={0x138, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x0, 0x0, 0xd, 0xa, 0x80, 0x80}, {@in6=@loopback, 0x4d2, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@dev={0xac, 0x14, 0x14, 0x19}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x794, 0x4e23, 0x7, 0x0, 0x0, 0x0, 0x3a}, {@in=@broadcast, 0x4d6, 0x6c}, @in6=@dev={0xfe, 0x80, '\x00', 0x36}, {0x3, 0x192, 0x6, 0x2, 0x3, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x3, 0xfffffff9, 0x40}, 0x70bd2a, 0x34fc, 0x2, 0x1, 0xfe, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0)
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
sendto$inet6(r0, &(0x7f0000000380)="4e813cbfba", 0x5, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='highspeed', 0x9)
shutdown(r0, 0x1)
executing program 3:
socket$netlink(0x10, 0x3, 0x0)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='for', 0x3)
executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000780)={0x2b, 0x2b, '\x00', [@padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x8, {0x3, 0x0, 0x79, 0x7}}, @calipso={0x7, 0x48, {0x0, 0x10, 0xc0, 0x1, [0x73, 0x934, 0xfff, 0x5, 0x4, 0x3, 0x1, 0x4]}}, @generic={0xa1, 0x5b, "59cb7288795557ea9b476f3cdb080e63b0687cfaadbe599ac45d6d9071575e05df28a3621a9e375e5d18423e41aafd04bd5c9a63b238058141a021516617cb0bdd08f1e49a8a23412561a9421553c62b7720908b23437f9ca7c336"}, @pad1, @calipso={0x7, 0x10, {0x0, 0x2, 0x51, 0xf, [0xfe]}}, @generic={0x6, 0x87, "9a01485ecac729407a0390fc142e75498f5b3f81a83039a4a1bfaef9e1731bc1400d7af38b66731fc290724a29b93a088fca4ca0fa6e7ca5d52789b8fc1b4288ecac3bdc903f17cc4fc2c7908070b70034f6f8ddfaf7a78eb482c76d46b874faef2ecc3119da102289d7777570b235deb851b9201c076c91eb874b616201d00f0681dfb294ec0e"}]}, 0x160)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000900)={0x200000000000001}, 0x8)
connect$inet6(r0, &(0x7f0000000940)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f00000009c0), 0x171}}], 0x400000000000172, 0x4000000)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000a00)={0x2, {{0xa, 0x4e21, 0x80, @mcast1, 0x7}}, {{0xa, 0x4e22, 0x3, @remote, 0xe}}}, 0x108)
executing program 6:
unshare(0x400)
r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x1, 0x18)
symlinkat(&(0x7f0000000000)='.\x00', r1, &(0x7f0000000140)='./file0\x00')
openat2(r1, &(0x7f00000008c0)='./file0/../file0\x00', &(0x7f0000000380)={0x100, 0x0, 0x11}, 0x18)
executing program 5:
mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000bc0)='./proc\x00', 0x1a8)
mount(0x0, &(0x7f0000000dc0)='./proc\x00', &(0x7f0000000e00)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000e40)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0)
write(r0, &(0x7f0000000e80)='7', 0x1)
futex(0x0, 0xd, 0x0, 0x0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x2, 0x0)
write(r1, &(0x7f0000000380)='2', 0x1)
write$sysctl(r0, &(0x7f0000000240)='7\x00', 0x2)
executing program 3:
r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000540)='.log\x00', 0x1c10c1, 0x9c37611dc13d0db7)
fchown(r0, 0x0, 0xee01)
r1 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r2=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0xee01, r2, 0x0)
fchown(r0, r2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
setreuid(0x0, 0xee00)
fchown(r0, 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0)
executing program 6:
epoll_create1(0x80000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="60000000020601080000000000000000000000010500010006000000050005000200000005000400000000000900020073797a3100000000140007800800064000000003080013400000040511000300686173683a6970"], 0x60}}, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080)
executing program 5:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000240)=ANY=[@ANYBLOB="1201100154e108101e041840b4ed010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000840)={0x40, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0)
bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1900"], 0x50)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002bbd7000fddbdf253700000008000300", @ANYRES32=r1, @ANYBLOB="080026006c0900000800a0006c09000008005700881300000800a10000100000080027"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x90)
executing program 3:
setns(0xc9, 0x40000000)
r0 = socket$inet6(0xa, 0x2, 0x0)
ioctl(r0, 0x8914, &(0x7f0000000000)="7770616e3000000000000000000000000100"/40)
ioctl(r0, 0x8914, &(0x7f0000000040)="6c6f7770616e300000000000000000000100"/40)
setsockopt(r0, 0x1, 0x19, &(0x7f0000000080)='lowpan0\x00', 0x8)
sendto$inet6(r0, &(0x7f0000000100)='lowpan_payload', 0xe, 0x0, &(0x7f0000000140)={0xa, 0x1234, 0x0, @empty}, 0x1c)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000a80)={0x1, &(0x7f0000000ac0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]})
close_range(r0, 0xffffffffffffffff, 0x0)
openat$ptp0(0xffffffffffffff9c, &(0x7f0000000b00), 0x0, 0x0)
clock_gettime(0xfffffffffffffffb, 0x0)
executing program 0:
r0 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r0, &(0x7f0000000200)={0xa, 0xf3, 0x14, @mcast1, 0x9}, 0x1c)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000280)=0x655e, 0x4)
r1 = dup2(r0, r0)
write$tun(r1, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x46)
recvmmsg(r1, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0}, 0x3ff}], 0x1, 0x2000, 0x0)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x4, 0x6, 0xbaa}, 0x48)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0), 0xa7c, r0}, 0x38)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.dequeue\x00', 0x26e1, 0x0)
close(r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240))
ioctl$SIOCSIFHWADDR(r1, 0x8b19, &(0x7f0000000280)={'wlan0\x00', @random="7cf1e97c9e4f"})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0))
ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8)
ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800000000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x0, 0x0)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800004000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x4, 0xfffffffd)
executing program 1:
setns(0xc9, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2)
ftruncate(r1, 0xffff)
fcntl$addseals(r1, 0x409, 0x3)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r1, 0x1, 0x0, 0x2000})
ioctl$DMA_BUF_SET_NAME_A(r2, 0x40046201, &(0x7f0000000140)='log\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/video4linux/video0/dev_debug\x00', 0x1, 0x0)
write(r0, &(0x7f0000000640)='3', 0x1)
r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0)
ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f00000006c0)={0x9d0000, 0x5, 0x8, r0, 0x0, &(0x7f0000000700)={0x98090d, 0x9, '\x00', @value64=0x1000000005a9}})
executing program 1:
mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b)
mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0)
mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x10454ca, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 32:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 33:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42040, 0x1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x12, r1, 0xc76ed000)
write(r0, &(0x7f0000000040)='an0m', 0x4)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <15>
bisect: split chunk #0 of len 15 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2)
ftruncate(r1, 0xffff)
fcntl$addseals(r1, 0x409, 0x3)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r1, 0x1, 0x0, 0x2000})
ioctl$DMA_BUF_SET_NAME_A(r2, 0x40046201, &(0x7f0000000140)='log\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/video4linux/video0/dev_debug\x00', 0x1, 0x0)
write(r0, &(0x7f0000000640)='3', 0x1)
r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0)
ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f00000006c0)={0x9d0000, 0x5, 0x8, r0, 0x0, &(0x7f0000000700)={0x98090d, 0x9, '\x00', @value64=0x1000000005a9}})
executing program 1:
mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b)
mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0)
mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x10454ca, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 32:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 33:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42040, 0x1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x12, r1, 0xc76ed000)
write(r0, &(0x7f0000000040)='an0m', 0x4)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000a80)={0x1, &(0x7f0000000ac0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]})
close_range(r0, 0xffffffffffffffff, 0x0)
openat$ptp0(0xffffffffffffff9c, &(0x7f0000000b00), 0x0, 0x0)
clock_gettime(0xfffffffffffffffb, 0x0)
executing program 0:
r0 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r0, &(0x7f0000000200)={0xa, 0xf3, 0x14, @mcast1, 0x9}, 0x1c)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000280)=0x655e, 0x4)
r1 = dup2(r0, r0)
write$tun(r1, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x46)
recvmmsg(r1, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0}, 0x3ff}], 0x1, 0x2000, 0x0)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x4, 0x6, 0xbaa}, 0x48)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0), 0xa7c, r0}, 0x38)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.dequeue\x00', 0x26e1, 0x0)
close(r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240))
ioctl$SIOCSIFHWADDR(r1, 0x8b19, &(0x7f0000000280)={'wlan0\x00', @random="7cf1e97c9e4f"})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0))
ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8)
ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800000000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x0, 0x0)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800004000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x4, 0xfffffffd)
executing program 1:
setns(0xc9, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0))
ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8)
ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800000000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x0, 0x0)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800004000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x4, 0xfffffffd)
executing program 1:
setns(0xc9, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6]
detailed listing:
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0))
ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8)
ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800000000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x0, 0x0)
pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002800004000400600000a0000010a000002005000500000000100000001501003e800000000", 0x2a}], 0x1, 0x4, 0xfffffffd)
executing program 1:
setns(0xc9, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-bind$inet-setsockopt$inet_int-ioctl$KDGKBENT-syz_emit_ethernet-recvmmsg
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f00000002c0)=0x803, 0x4)
ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0xffffffffffffffff)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@local, @random="facfff00716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x26, 0x24, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-socket$netlink-writev
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-socket$netlink-writev
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)

program crashed: kernel BUG in svc_destroy
bisect: concatenation succeeded
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-socket$netlink
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)
socket$netlink(0x10, 0x3, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f00000002c0)='tcp 2', 0x5)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
reproducing took 51m9.310882213s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:599!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4382 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:599
Code: 5f 5d e9 3f c6 bb f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 a6 5a bc f8 e9 17 ff ff ff e8 ac 15 77 f8 <0f> 0b e8 a5 15 77 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc9000318fad0 EFLAGS: 00010293
RAX: ffffffff89020db4 RBX: ffff888025a82050 RCX: ffff88801bb89dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000318fc78 R08: ffffffff91046207 R09: 1ffffffff2208c40
R10: dffffc0000000000 R11: fffffbfff2208c41 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888025a82068 R15: 0000000000000001
FS:  0000555555966500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33463fff CR3: 000000007391d000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:770 [inline]
 __write_ports fs/nfsd/nfsctl.c:796 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:849
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x304/0xd70 fs/read_write.c:592
 ksys_write+0x153/0x260 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f32c816a559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc53dba18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f32c83f0fa0 RCX: 00007f32c816a559
RDX: 0000000000000005 RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007f32c8201b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f32c83f0fac R14: 00007f32c83f0fa0 R15: 00007f32c83f0fa0
 </TASK>
Modules linked in:
---[ end trace ef427458e56392a8 ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:599
Code: 5f 5d e9 3f c6 bb f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 a6 5a bc f8 e9 17 ff ff ff e8 ac 15 77 f8 <0f> 0b e8 a5 15 77 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc9000318fad0 EFLAGS: 00010293
RAX: ffffffff89020db4 RBX: ffff888025a82050 RCX: ffff88801bb89dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000318fc78 R08: ffffffff91046207 R09: 1ffffffff2208c40
R10: dffffc0000000000 R11: fffffbfff2208c41 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888025a82068 R15: 0000000000000001
FS:  0000555555966500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020f1faf83000 CR3: 000000007391d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:599!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4382 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:599
Code: 5f 5d e9 3f c6 bb f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 a6 5a bc f8 e9 17 ff ff ff e8 ac 15 77 f8 <0f> 0b e8 a5 15 77 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc9000318fad0 EFLAGS: 00010293
RAX: ffffffff89020db4 RBX: ffff888025a82050 RCX: ffff88801bb89dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000318fc78 R08: ffffffff91046207 R09: 1ffffffff2208c40
R10: dffffc0000000000 R11: fffffbfff2208c41 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888025a82068 R15: 0000000000000001
FS:  0000555555966500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33463fff CR3: 000000007391d000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:770 [inline]
 __write_ports fs/nfsd/nfsctl.c:796 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:849
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x304/0xd70 fs/read_write.c:592
 ksys_write+0x153/0x260 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f32c816a559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc53dba18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f32c83f0fa0 RCX: 00007f32c816a559
RDX: 0000000000000005 RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007f32c8201b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f32c83f0fac R14: 00007f32c83f0fa0 R15: 00007f32c83f0fa0
 </TASK>
Modules linked in:
---[ end trace ef427458e56392a8 ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:599
Code: 5f 5d e9 3f c6 bb f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 a6 5a bc f8 e9 17 ff ff ff e8 ac 15 77 f8 <0f> 0b e8 a5 15 77 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc9000318fad0 EFLAGS: 00010293
RAX: ffffffff89020db4 RBX: ffff888025a82050 RCX: ffff88801bb89dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000318fc78 R08: ffffffff91046207 R09: 1ffffffff2208c40
R10: dffffc0000000000 R11: fffffbfff2208c41 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888025a82068 R15: 0000000000000001
FS:  0000555555966500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020f1faf83000 CR3: 000000007391d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400